CVE-2023-20208
Vulnerability from cvelistv5
Published
2023-11-21 18:48
Modified
2024-08-02 09:05
Severity ?
EPSS score ?
Summary
A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the web-based management interface of an affected device.
References
Impacted products
▼ | Vendor | Product |
---|---|---|
Cisco | Cisco Identity Services Engine Software |
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-02T09:05:35.585Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "cisco-sa-ise-mult-j-KxpNynR", "tags": [ "x_transferred" ], "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-mult-j-KxpNynR" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "Cisco Identity Services Engine Software", "vendor": "Cisco", "versions": [ { "status": "affected", "version": "3.0.0" }, { "status": "affected", "version": "3.0.0 p1" }, { "status": "affected", "version": "3.0.0 p2" }, { "status": "affected", "version": "3.0.0 p3" }, { "status": "affected", "version": "3.0.0 p4" }, { "status": "affected", "version": "3.0.0 p5" }, { "status": "affected", "version": "3.0.0 p6" }, { "status": "affected", "version": "3.0.0 p7" }, { "status": "affected", "version": "3.1.0" }, { "status": "affected", "version": "3.1.0 p1" }, { "status": "affected", "version": "3.1.0 p3" }, { "status": "affected", "version": "3.1.0 p4" }, { "status": "affected", "version": "3.1.0 p5" } ] } ], "descriptions": [ { "lang": "en", "value": "A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the web-based management interface of an affected device." } ], "exploits": [ { "lang": "en", "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "format": "cvssV3_1" } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-87", "description": "Improper Neutralization of Alternate XSS Syntax", "lang": "en", "type": "cwe" } ] } ], "providerMetadata": { "dateUpdated": "2024-01-25T16:57:59.949Z", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco" }, "references": [ { "name": "cisco-sa-ise-mult-j-KxpNynR", "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-mult-j-KxpNynR" } ], "source": { "advisory": "cisco-sa-ise-mult-j-KxpNynR", "defects": [ "CSCwc45750" ], "discovery": "EXTERNAL" } } }, "cveMetadata": { "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2023-20208", "datePublished": "2023-11-21T18:48:44.114Z", "dateReserved": "2022-10-27T18:47:50.367Z", "dateUpdated": "2024-08-02T09:05:35.585Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2023-20208\",\"sourceIdentifier\":\"ykramarz@cisco.com\",\"published\":\"2023-11-21T19:15:08.567\",\"lastModified\":\"2024-01-25T17:15:36.040\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the web-based management interface of an affected device.\"},{\"lang\":\"es\",\"value\":\"Una vulnerabilidad en la interfaz de administraci\u00f3n basada en web de Cisco ISE podr\u00eda permitir que un atacante remoto autenticado lleve a cabo un ataque XSS contra un usuario de la interfaz de administraci\u00f3n basada en web de un dispositivo afectado.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":1.7,\"impactScore\":2.7},{\"source\":\"ykramarz@cisco.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.8,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":1.7,\"impactScore\":2.7}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]},{\"source\":\"ykramarz@cisco.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-87\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.0.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"A1063044-BCD7-487F-9880-141C30547E36\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch1:*:*:*:*:*:*\",\"matchCriteriaId\":\"DA42E65A-7207-48B8-BE1B-0B352201BC09\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch2:*:*:*:*:*:*\",\"matchCriteriaId\":\"75DDAF38-4D5F-4EE4-A428-68D28FC0DA96\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch3:*:*:*:*:*:*\",\"matchCriteriaId\":\"C5FB6AA6-F8C9-48A6-BDDA-1D25C43564EB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch4:*:*:*:*:*:*\",\"matchCriteriaId\":\"2B3A267A-5FEA-426D-903E-BD3F4F94A1A4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1B3207B-1B9C-41AA-8EF6-8478458462E7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch6:*:*:*:*:*:*\",\"matchCriteriaId\":\"C5B9E7F3-B0F2-4A6A-B939-A62E9B12CCEB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch7:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF4C5A58-D0AE-48D6-9757-18C1D5BE5070\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.1:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"C4DB9726-532F-45CE-81FD-45F2F6C7CE51\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.1:patch1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E8F0066-0EC0-41FD-80BE-55C4ED5F6B0E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.1:patch2:*:*:*:*:*:*\",\"matchCriteriaId\":\"A1E81F86-7ED6-4D6C-8DAF-09EB2A7BC496\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.1:patch3:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D1765DB-1BEF-4CE9-8B86-B91F709600EB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.1:patch4:*:*:*:*:*:*\",\"matchCriteriaId\":\"3D1E80EF-C3FD-4F7A-B63D-0EAA5C878B11\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.1:patch5:*:*:*:*:*:*\",\"matchCriteriaId\":\"095F27EC-5713-4D4F-AD06-57D3DF068B90\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:cisco:identity_services_engine:3.2:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"36722B6C-64A5-4D00-94E1-442878C37A35\"}]}]}],\"references\":[{\"url\":\"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-mult-j-KxpNynR\",\"source\":\"ykramarz@cisco.com\",\"tags\":[\"Vendor Advisory\"]}]}}" } }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.