Cisco Identity Services Engine (cisco-sa-ise-xss-964cdxW5)

#TRUSTED 0e829e448de1be5e8e660f0a5963f76818bb322f69df0f9e94653ad1e0a20b8918c734effaa37f7e75c19dbbf49c78bd71f80642ccce5cbae4105e74f2a10ac127de9ce886e1d57a5b08b1199ca13f24e2c896c8303a1608a2ade529bf13f1e8dc96b5c160638ccc7621e8e3f0cfabdf570526d7b8ad52778714aebdac9613991d9f2aea69cf554317fc66809db1ba92316b64e3a9d721b430c137192311e57068fba2bee68854d05cfa9d8c020841233671e7cbd234d22c260b65bb9ab2a3d884f2a59b04b29b9038ae8601f44dd21b80d3206bd8a310dc6cf2115ba242b2a797bd67246d5f5c83bb09d255befb10dd256192534097444844518d116dbaf26ec2a3a961d827d828f87f1b893cdd40755e1ebe826a1bec4d5b05f2ce4daf7c670c5a9cbf14b17086e255da25f74ae091681e39934afa94548f7eec35968589366d9d577f1e07d2ab8d4d7dd1767824c82f04e24f80ca0954d8e7f97c1a6e57ae057f690512bd658dba6deeb2616ec13fc7284421b62e65b67eec7f6138f2290e5cac6ef7d1bf35a34467cb85bdaec56efed62034f88cae8c3ba01bb703990c0775b6ef7206e64b78a8c4bb686be7bfc81cd2d7f3cc52689730b287ce3eac5c70d169ae2b67a7232eabdaa2efb75eb41abb07e81a6d0f29d2c9ac18ec106761d42ade67c29503d697e5a93d98b83ce56bba3e89ad87a902c49bcf058d03cf2d13
#TRUST-RSA-SHA256 af9664aef1ede6db249b0472412cd958b3a29cba35db3240fddb15ff8a6e4ce21d32f0473fe28a48012f6bbb1df75bc103dbf52b7cce0df804235567b40a47024116821bd421f6c943b731a1abc16cfbe798c3fa374093a8e087ae00cd6ea194a7835fa9cc6aa689acb54c8e75cf12b993a8c883c8ce64efe6aaa04c5a69944fe24efad870948fb12896987f7ce5ee1384f0228f49052b06c2969c3ec12a07fd9f54782995fe5f99e8874ab1f481b542e8e8c746dac75cbc56d7e279564b0df196254608ad1f16f4aeb9482a1949b2c4a246175815e3a92bdf6c79daa4df7a9df89081476a53317eeb3ef966eb645f14a61b91e6b03f15c485d63e27ec933c1c3d2e09ae95c4d113e6deb366273c5b9259a17ef00ba0cde771a322e4c60ae5b6456983fbf0d068fb3d76ccb71f0daa2f364ca47ac73208d2d082420b3da784a997f1bb61853ac82cae6f71334feac8242e3efaaed77c4461ee79fd3b59d10dd4642072d1aa52f90288a515a55d07e90cecec89571ca328f3516246d1ef585d2061a59c125cc3b7a57d5bbb6ee492c292842ed03bd7f430323caf7dba0ee62be76ee2b7d3d7055a80321bf774b5427c6a3912b66e1ae2352dc670335a4fcd86dc92f4e6b4ee774a4b25fb1650c2046bd572d697631d091f329ad431678a90d0cdf42f3685e756ec725a71e8fdebad0d82ac2571e747b5b614035ec79d3433e269
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(286276);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/30");

  script_cve_id("CVE-2026-20047");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwq83752");
  script_xref(name:"CISCO-SA", value:"cisco-sa-ise-xss-964cdxW5");
  script_xref(name:"IAVA", value:"2025-A-0819-S");

  script_name(english:"Cisco Identity Services Engine (cisco-sa-ise-xss-964cdxW5)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco ISE is affected by a vulnerability.

  - A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco
    ISE Passive Identity Connector (ISE-PIC) could allow an authenticated, remote attacker to conduct cross-
    site scripting (XSS) attacks against a user of the interface. This vulnerability is due to insufficient
    validation of user-supplied input by the web-based management interface of an affected system. An attacker
    could exploit this vulnerability by injecting malicious code into specific pages of the interface. A
    successful exploit could allow the attacker to execute arbitrary script code in the context of the
    affected interface or access sensitive, browser-based information. To exploit this vulnerability, the
    attacker must have valid administrative credentials. (CVE-2026-20047)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-964cdxW5
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0bb3b816");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwq83752");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug ID CSCwq83752");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:M/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-20047");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(80);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/01/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/01/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:identity_services_engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:identity_services_engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:identity_services_engine_software");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ise_detect.nbin");
  script_require_keys("Host/Cisco/ISE/version");

  exit(0);
}

include('ccf.inc');
include('cisco_ise_func.inc');

var product_info = cisco::get_product_info(name:'Cisco Identity Services Engine Software');

product_info = strip_fourth_segment(product_info:product_info);

var vuln_ranges = [
 {'min_ver': '1.0', 'fix_ver': '3.2', 'required_patch': '8'},
 {'min_ver': '3.3', 'fix_ver': '3.3', 'required_patch': '8'},
 {'min_ver': '3.4', 'fix_ver': '3.4', 'required_patch': '4'}
];

var required_patch = get_required_patch(vuln_ranges:vuln_ranges, version:product_info['version']);

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_WARNING,
  'version'       , product_info['version'],
  'flags'         , {'xss':TRUE},
  'bug_id'        , 'CSCwq83752',
  'disable_caveat', TRUE,
  'fix'           , 'See vendor advisory'
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges,
  required_patch:required_patch
);