Cisco Identity Services Engine Stored XSS (cisco-sa-ise-xss-42tgsdMG)

#TRUSTED 03b7aad910212aead418404d809deb737bd72dc5e18e38dbb3399e620de0b296b8ca9ea5b9d06821bbd4a7e784e643ed71a92536fb54776285196a1385dded335e135342dda16e90eaf3d08bab03fe17e1d6e99ed8eb9cf3aef94b597c4b2a971e826dc041e8ecabf066332ec9670eb3bec7d8d86869ae78deac213b51513df1630f172cea4dceda6fd42f9dbfa250ff1f3497986f5490e5efad629e1d9675e1b05856ca94ba5605255599e64e4c1c02a6cb08edfdbb0ecb71cfeea105ae2b49e729758b7d0c8712584d49c079fff6ed1c9e75ac8f8325e02b8ae9425a063735eccca7553271437d6b89795e3daf34b459712526aed94fe060227e3d2c4c6c4785fd8b85c211e7c5275b43b63b636fd622cb40ac93aff5f0033ad5beb372ce903eb8034642bca7a0d84f83b89e4a225eb7436bc36eb332723ff6a095d457d182bd013c76c4eed09db3940fa064305432135ccc2097dafa4ad2cb2a0d8c900f5061324b3713a59165e1414dd3296fc6498a31091a35ec418d5e6d32e6d9333ed99f66cfc4e34c93798dc68960badbbea3e5601d7631bda7685ade7b8ff3497797551942d58fe94fe63c2b767a7f858733dfd84afe50b99d913d12d1eeac62938f20cefada20242a89bc198015b1d56d1e162ef5d944dd57551817ebe0060411667fa8d92864651aefb3bec4068cb251777a48b1a2d6ad98fd96bd35b5f82b3527
#TRUST-RSA-SHA256 680bfe07d92978ee0fef47beb416d21bdfdd772181594564f16850f5b5e1b951b39d13bb32480945da3e78fb989f05b201bcf994938c05b1b3301a6d3501d6e874dbbb770e8fde4fbac9f6ca0a9b19a5829caa7ad74e89388dd8804e33b45d5606aa7045522e41a4bc9c4a6bb394def25ae2f00dc51ea0cb478b7141386ee1fbfa1710510e51255efaea4635207067c8d628b923c2b213985453c0f3d0f8ac8d95acd4e1085424c02c5a917da00907d6190ade4810c1ebfee02fbad7305ed668f99b8f3add5f9708535bc22209e1761f6be9b4929d67ee619ad1ff00d67bd5a99b5844c4799524399a242c7458d5d4d00cc1bad67141799590d3897e702bef8331745f179ac4ab37d599555587d52e237e90dd1c41cae6749afdb189dceb384e6527e300bc1cdb3e4b4a7b2d984a6ed66b8af2da5a036f56d9beb42587c496a5a5824a7b8ccf07d81f7a0d78ccda7ef2131f6b17ca82a9c960d5df8570e3f2aea352619b2d70d1d2b0b266aa2136f45252e05559e632b23c515ba731f32d1c3cf2717094fea8dc3e589b13d0ba1a193e85bfc1c79b19b720387345188a079c782224bc744012290a5351fc7179f634f699dc29662223371cedc6767aed8394c4fa719b22667bf30f2eb2463ec75cefafa0bbd66b7198ffb10b989755d26314c404301c7f1e14141210e1e433377d6729664f6eb13232153b89f33d0a868fcde7
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(215123);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/05/22");

  script_cve_id("CVE-2025-20205");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwj04202");
  script_xref(name:"CISCO-SA", value:"cisco-sa-ise-xss-42tgsdMG");
  script_xref(name:"IAVA", value:"2024-A-0710-S");

  script_name(english:"Cisco Identity Services Engine Stored XSS (cisco-sa-ise-xss-42tgsdMG)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerabilities is
affected by a vulnerability:

  - A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow
    an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the
    interface. This vulnerability is due to insufficient validation of user-supplied input by the web-
    based management interface of an affected system. An attacker could exploit this vulnerability by
    injecting malicious code into specific pages of the interface. A successful exploit could allow the
    attacker to execute arbitrary script code in the context of the affected interface or access sensitive,
    browser-based information. To exploit this vulnerability, the attacker must have valid administrative
    credentials. (CVE-2025-20205)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-42tgsdMG
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?e2070210");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwk32089");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwk32089");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:M/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-20205");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(79);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/02/05");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/02/05");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/02/07");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:identity_services_engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:identity_services_engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:identity_services_engine_software");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ise_detect.nbin");
  script_require_keys("Host/Cisco/ISE/version");

  exit(0);
}

include('ccf.inc');
include('cisco_ise_func.inc');

var product_info = cisco::get_product_info(name:'Cisco Identity Services Engine Software');

# the 4th segement is not relevant in Cisco ISE
product_info = strip_fourth_segment(product_info:product_info);

var vuln_ranges = [
  {'min_ver':'3.0', 'fix_ver':'3.2', required_patch:'7'},
  {'min_ver':'3.3', 'fix_ver':'3.3', required_patch:'4'},
  {'min_ver':'3.4', 'fix_ver':'3.4', required_patch:'1'},
];

var required_patch = get_required_patch(vuln_ranges:vuln_ranges, version:product_info['version']);

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_WARNING,
  'version'       , product_info['version'],
  'flags'         , {'xss':TRUE},
  'bug_id'        , 'CSCwk32089',
  'disable_caveat', TRUE
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges,
  required_patch:required_patch
);