Lucene search

CiscoCVE-2018-0327

HistoryMay 17, 2018 - 3:29 a.m.

CVE-2018-0327

2018-05-1703:29:00

CWE-79

cisco

web.nvd.nist.gov

cisco

ise

web framework

vulnerability

cve-2018-0327

cross-site scripting

xss

cisco bug ids

cscvg86743

nvd

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

43.6%

JSON

A vulnerability in the web framework of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software via the HTTP GET and HTTP POST methods. An attacker who can convince a user to follow an attacker-supplied link could execute arbitrary script or HTML code in the user’s browser in the context of an affected site. Cisco Bug IDs: CSCvg86743.

Affected configurations

Nvd

Node

ciscoidentity_services_engine_softwareMatch2.1\(0.905\)

AND

ciscoidentity_services_engineMatch-

VendorProductVersionCPE
ciscoidentity_services_engine_software2.1(0.905)cpe:2.3:a:cisco:identity_services_engine_software:2.1\(0.905\):*:*:*:*:*:*:*
ciscoidentity_services_engine-cpe:2.3:h:cisco:identity_services_engine:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	identity_services_engine_software	2.1(0.905)	cpe:2.3:a:cisco:identity_services_engine_software:2.1\(0.905\):::::::*
cisco	identity_services_engine	-	cpe:2.3:h:cisco:identity_services_engine:-:::::::*

CNA Affected

[
  {
    "product": "Cisco Identity Services Engine",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Identity Services Engine"
      }
    ]
  }
]

References

www.securityfocus.com/bid/104194

www.securitytracker.com/id/1040926

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-ident-se-xss

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

43.6%

JSON

Related for CVE-2018-0327