CVE-2015-4268

2015-07-1417:59:04

CWE-79

[email protected]

web.nvd.nist.gov

cve-2015-4268

cross-site scripting

xss

infra admin ui

cisco

identity services engine

ise

remote attack

bug id cscus16052

5.9 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

43.3%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in the Infra Admin UI in Cisco Identity Services Engine (ISE) 1.2(1.198) and 1.3(0.876) allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in a (1) GET or (2) POST request, aka Bug ID CSCus16052.

Affected configurations

NVD

Node

ciscoidentity_services_engine_softwareMatch1.2\(1.198\)

ciscoidentity_services_engine_softwareMatch1.3\(0.876\)

CPENameOperatorVersion
cisco:identity_services_engine_softwarecisco identity services engine softwareeq1.2\(1.198\)
cisco:identity_services_engine_softwarecisco identity services engine softwareeq1.3\(0.876\)

CPE	Name	Operator	Version
cisco:identity_services_engine_software	cisco identity services engine software	eq	1.2\(1.198\)
cisco:identity_services_engine_software	cisco identity services engine software	eq	1.3\(0.876\)