Cisco Identity Services Engine (cisco-sa-isexss-BS8ctE7U)

#TRUSTED 6da824ea6939ed4da06e4b39b0b801945d3a54cef11b0b0e756ee759a513c6410e86686313df14cf9dedf91f9c716b0753ab1b2bed52c31b192440a2b3c5a8aef18c72a72e6b324cdfdbf38750f29fc0690c3189d1ca51d21bd47dbc3a405b15e6fdf0723f3e0883f64c131f2a572215b24312c2c610c7e9e16c106ecc152d0833331908ef13e1fb59cc1f1c899743b5a1ddc44a107e77d587056ef8013e6017630e143c8b940b04e16eaaf1a753ce4fb8f5c3ae4a76f529ba648291050894a416b51cd293bf9c955dcba1cc8a4c123bbd2f428876b645a5d55c61139380d9bb2dabec99eb1fa9e45f836ae28ab6ba63cf5723875feb0b645a6ada8985b901d6cde36d77b21943e88d551d2171085f856e56b2e486f18f82812ae458fa237fe2cbf7e7d483ffa5663e379d30ff907f12eb13edb7474cb3b9497e4915317833951af32d6dfe09716fb182503b5527176453b810f5787bffe8cfc8af64df4c720c0d8f4abb5d2366294b834d56ef2b24a1a1de6d9cd0aa3e5fbb349d3f4b7298814f658c13f5de131ea1600010635cb729556e6fa3b0fefaac889c385ba78b9a7333fbdd790b0f8c166725d57dcf46d1a04fe55b2aaa0c3f953ac515555a6a3d485dcc7c64e967d9f72b4858a51d7dcbbc0e06caa713a838bbc09ac19281eb189992b660017af94feab2bcc6a304ad167ae2c18efcade3d54a333b2be00fb0b953
#TRUST-RSA-SHA256 479bb9aa0c3639d7ae231e449118de6ec4c6986f07187035fd85a46094c0a1f9565b5cbacaea28be7a90d4a4008a618883705cf1243f8c870fcbd0991f92c1d2085151374e22fe91939db5487554a6d3e79a1f6c819e7cae83c446a3b42c2e066f8a4df86e44bb0154abc1a3841a5c02fdde884bfe7a0084cd7011ebd5717bab9b65c3748709fd0b129a37ad72fa949d350a1446318b8b9f8ac2a780ecd12f5f382fe5b35c725f4462c014620208efeeb7fdaca9965e51a71a62716a20c8f23b9e559a9e6cdda1a2e31a726af15a425116073776f6d35d484d9bf2f646693bac6720ad438f04cd69f2322d6917d23b815a607ecc4ee1d95ecdec500a0bafa8a088a7e90706d137e22b8eb32b873ee7eba5d8464d90d8acd7fc708a955c1e6797dcdc051e16a963b71c16517e9eb2ac2b2d0012eaa5f5b4a3bb0186784aca02a31334384bc9311abee67b0d1cbd240329cd1cdc4577b5fcceebfde039a1ade99ff5c7a847db08c1c9dc836e19b41ccb80ec292872f442be684fd28d3411da736b7f11a74bb68edc369b2de774837d05c909ed954f9a886f4482830089e61c09ba135732493a62f41d8005b8e8ab233957c629a59b0e8ca1384e10ea0570a37644201472f87b66e96073b85955fe89212f46739db1aea936c60a6c8f8604c9c2b1bcf9ade5b668481e967dbb2a745dc05ae9a2c53fc446753b946a5490b78e1fc8
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(306558);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/17");

  script_cve_id("CVE-2026-20132");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn85868");
  script_xref(name:"CISCO-BUG-ID", value:"CSCwn87479");
  script_xref(name:"CISCO-SA", value:"cisco-sa-isexss-BS8ctE7U");
  script_xref(name:"IAVA", value:"2026-A-0357");

  script_name(english:"Cisco Identity Services Engine (cisco-sa-isexss-BS8ctE7U)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, Cisco ISE is affected by a vulnerability.

  - Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE)
    could allow an authenticated, remote attacker with administrativewrite privileges to conduct a
    stored cross-site scripting (XSS) attack or a reflected XSS attack against a user of the web-based
    management interface of an affected device. These vulnerabilities are due to insufficient sanitization of
    user-supplied data that is stored in the web page. An attacker could exploit these vulnerabilities by
    convincing a user of the interface to click a specific link or view an affected web page. The injected
    script code may be executed in the context of the web-based management interface or allow the attacker to
    access sensitive browser-based information. (CVE-2026-20132)

Please see the included Cisco BIDs and Cisco Security Advisory for more information.");
  # https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-isexss-BS8ctE7U
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?d1d7cb38");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn85868");
  script_set_attribute(attribute:"see_also", value:"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwn87479");
  script_set_attribute(attribute:"solution", value:
"Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCwn85868, CSCwn87479");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:M/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-20132");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(79);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/04/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/04/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/04/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/h:cisco:identity_services_engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:identity_services_engine");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:cisco:identity_services_engine_software");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"II");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CISCO");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("cisco_ise_detect.nbin");
  script_require_keys("Host/Cisco/ISE/version");

  exit(0);
}

include('ccf.inc');
include('cisco_ise_func.inc');

var product_info = cisco::get_product_info(name:'Cisco Identity Services Engine Software');

product_info = strip_fourth_segment(product_info:product_info);

var vuln_ranges = [
 {'min_ver': '1.0', 'fix_ver': '3.2', 'required_patch': '8'},
 {'min_ver': '3.3', 'fix_ver': '3.3', 'required_patch': '5'},
 {'min_ver': '3.4', 'fix_ver': '3.4', 'required_patch': '2'}
];

var required_patch = get_required_patch(vuln_ranges:vuln_ranges, version:product_info['version']);

var reporting = make_array(
  'port'          , 0,
  'severity'      , SECURITY_WARNING,
  'version'       , product_info['version'],
  'flags'         , {'xss':TRUE},
  'bug_id'        , 'CSCwn85868, CSCwn87479',
  'disable_caveat', TRUE,
  'fix'           , 'See vendor advisory'
);

cisco::check_and_report(
  product_info:product_info,
  reporting:reporting,
  vuln_ranges:vuln_ranges,
  required_patch:required_patch
);