GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2021-34738 (GCVE-0-2021-34738)

Vulnerability from cvelistv5 – Published: 2021-10-21 02:50 – Updated: 2024-11-07 21:47
VLAI
Title
Cisco Identity Services Engine Cross-Site Scripting Vulnerabilities
Summary
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabilities, see the Details section of this advisory.
Severity
6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-11-07 21:40 UTC
CWE
Assigner
References
URL Tags
https://tools.cisco.com/security/center/content/C… vendor-advisoryx_refsource_CISCO
Impacted products
Vendor Product Version CPE status
Cisco Cisco Identity Services Engine Software Affected: n/a
guessed Create a notification for this product.
Date Public
2021-10-20 00:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T00:19:48.193Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20211020 Cisco Identity Services Engine Cross-Site Scripting Vulnerabilities",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss1-rgxYry2V"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-34738",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-07T21:40:00.942758Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-07T21:47:31.025Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Identity Services Engine Software",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2021-10-20T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabilities, see the Details section of this advisory."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-10-21T02:50:11.000Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "20211020 Cisco Identity Services Engine Cross-Site Scripting Vulnerabilities",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss1-rgxYry2V"
        }
      ],
      "source": {
        "advisory": "cisco-sa-ise-xss1-rgxYry2V",
        "defect": [
          [
            "CSCvy11971",
            "CSCvy81868"
          ]
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco Identity Services Engine Cross-Site Scripting Vulnerabilities",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "DATE_PUBLIC": "2021-10-20T16:00:00",
          "ID": "CVE-2021-34738",
          "STATE": "PUBLIC",
          "TITLE": "Cisco Identity Services Engine Cross-Site Scripting Vulnerabilities"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cisco Identity Services Engine Software",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Cisco"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabilities, see the Details section of this advisory."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
          }
        ],
        "impact": {
          "cvss": {
            "baseScore": "6.1",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-79"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20211020 Cisco Identity Services Engine Cross-Site Scripting Vulnerabilities",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss1-rgxYry2V"
            }
          ]
        },
        "source": {
          "advisory": "cisco-sa-ise-xss1-rgxYry2V",
          "defect": [
            [
              "CSCvy11971",
              "CSCvy81868"
            ]
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2021-34738",
    "datePublished": "2021-10-21T02:50:11.767Z",
    "dateReserved": "2021-06-15T00:00:00.000Z",
    "dateUpdated": "2024-11-07T21:47:31.025Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-34738",
      "date": "2026-09-19",
      "epss": "0.00616",
      "percentile": "0.48145"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "776397EC-F775-4068-A811-D57FC2DDAF8C",
                  "versionEndExcluding": "2.6.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:-:*:*:*:*:*:*",
                  "matchCriteriaId": "8B45856E-6BE4-40A7-AE2F-4F9DC9315875",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch1:*:*:*:*:*:*",
                  "matchCriteriaId": "1F6D1780-3306-4481-A3CD-8F7732D955CC",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch2:*:*:*:*:*:*",
                  "matchCriteriaId": "07BF9702-0607-49A1-A82A-E4ADF1A4135F",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch3:*:*:*:*:*:*",
                  "matchCriteriaId": "11AA4EC0-6F3C-45A9-9AA4-0D81876F44B5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch5:*:*:*:*:*:*",
                  "matchCriteriaId": "1B4B88F0-3229-4B07-9308-C37C794595A0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch6:*:*:*:*:*:*",
                  "matchCriteriaId": "E02F0E61-FBFF-4C6D-9132-E266FF67802B",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch7:*:*:*:*:*:*",
                  "matchCriteriaId": "541EC483-540A-4080-AA69-82A0F30EE3D6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch8:*:*:*:*:*:*",
                  "matchCriteriaId": "66CAFE97-295F-48F7-A92C-A90D3B837483",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch9:*:*:*:*:*:*",
                  "matchCriteriaId": "68E172B4-867E-4413-9D45-F04B52270D41",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7:*:*:*:*:*:*:*",
                  "matchCriteriaId": "4A5D3792-5ECB-498A-967F-3564DDFB4B36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7\\(0.207\\):*:*:*:*:*:*:*",
                  "matchCriteriaId": "B82A55D0-F97A-4C8E-86E5-6F7683281290",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7\\(0.356\\):*:*:*:*:*:*:*",
                  "matchCriteriaId": "887E1D44-9739-40E1-8E9E-996FBE0CE823",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7\\(0.356\\):-:*:*:*:*:*:*",
                  "matchCriteriaId": "1002D75A-03DF-4958-8368-8F73F03C3E00",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7\\(0.903\\):*:*:*:*:*:*:*",
                  "matchCriteriaId": "8E0A5B82-0661-4F2F-932D-4BA3649EA62A",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:-:*:*:*:*:*:*",
                  "matchCriteriaId": "1F22FABF-2831-4895-B0A9-283B98398F43",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch1:*:*:*:*:*:*",
                  "matchCriteriaId": "B83D0F20-5A43-4583-AFAF-CD9D20352437",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch2:*:*:*:*:*:*",
                  "matchCriteriaId": "2887A2C0-BADA-41D3-AA6A-F10BC58AA7F9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch3:*:*:*:*:*:*",
                  "matchCriteriaId": "5ADE32BD-C500-47D8-86D6-B08F55F1BBDF",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch4:*:*:*:*:*:*",
                  "matchCriteriaId": "22F23314-96BE-42F6-AE07-CC13F8856029",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0\\(0.458\\):*:*:*:*:*:*:*",
                  "matchCriteriaId": "CDA8B438-3EAB-4383-B24B-22D08CB44EE5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:-:*:*:*:*:*:*",
                  "matchCriteriaId": "A1063044-BCD7-487F-9880-141C30547E36",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch1:*:*:*:*:*:*",
                  "matchCriteriaId": "DA42E65A-7207-48B8-BE1B-0B352201BC09",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch2:*:*:*:*:*:*",
                  "matchCriteriaId": "75DDAF38-4D5F-4EE4-A428-68D28FC0DA96",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch3:*:*:*:*:*:*",
                  "matchCriteriaId": "C5FB6AA6-F8C9-48A6-BDDA-1D25C43564EB",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabilities, see the Details section of this advisory."
        },
        {
          "lang": "es",
          "value": "M\u00faltiples vulnerabilidades en la interfaz de administraci\u00f3n basada en web Cisco Identity Services Engine (ISE) Software podr\u00edan permitir a un atacante conducir un ataque de tipo cross-site scripting (XSS) contra un usuario de la interfaz. Para obtener m\u00e1s informaci\u00f3n sobre estas vulnerabilidades, consulte la secci\u00f3n Detalles de este aviso"
        }
      ],
      "id": "CVE-2021-34738",
      "lastModified": "2024-11-21T06:11:05.257",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "MEDIUM",
              "accessVector": "NETWORK",
              "authentication": "NONE",
              "availabilityImpact": "NONE",
              "baseScore": 4.3,
              "confidentialityImpact": "NONE",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
              "version": "2.0"
            },
            "exploitabilityScore": 8.6,
            "impactScore": 2.9,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": true
          }
        ],
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 2.7,
            "source": "ykramarz@cisco.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.1,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "REQUIRED",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 2.7,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2021-10-21T03:15:06.940",
      "references": [
        {
          "source": "ykramarz@cisco.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss1-rgxYry2V"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss1-rgxYry2V"
        }
      ],
      "sourceIdentifier": "ykramarz@cisco.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-79"
            }
          ],
          "source": "ykramarz@cisco.com",
          "type": "Secondary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-79"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "776397EC-F775-4068-A811-D57FC2DDAF8C",
                    "versionEndExcluding": "2.6.0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:-:*:*:*:*:*:*",
                    "matchCriteriaId": "8B45856E-6BE4-40A7-AE2F-4F9DC9315875",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch1:*:*:*:*:*:*",
                    "matchCriteriaId": "1F6D1780-3306-4481-A3CD-8F7732D955CC",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch2:*:*:*:*:*:*",
                    "matchCriteriaId": "07BF9702-0607-49A1-A82A-E4ADF1A4135F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch3:*:*:*:*:*:*",
                    "matchCriteriaId": "11AA4EC0-6F3C-45A9-9AA4-0D81876F44B5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch5:*:*:*:*:*:*",
                    "matchCriteriaId": "1B4B88F0-3229-4B07-9308-C37C794595A0",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch6:*:*:*:*:*:*",
                    "matchCriteriaId": "E02F0E61-FBFF-4C6D-9132-E266FF67802B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch7:*:*:*:*:*:*",
                    "matchCriteriaId": "541EC483-540A-4080-AA69-82A0F30EE3D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch8:*:*:*:*:*:*",
                    "matchCriteriaId": "66CAFE97-295F-48F7-A92C-A90D3B837483",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch9:*:*:*:*:*:*",
                    "matchCriteriaId": "68E172B4-867E-4413-9D45-F04B52270D41",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4A5D3792-5ECB-498A-967F-3564DDFB4B36",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7\\(0.207\\):*:*:*:*:*:*:*",
                    "matchCriteriaId": "B82A55D0-F97A-4C8E-86E5-6F7683281290",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7\\(0.356\\):*:*:*:*:*:*:*",
                    "matchCriteriaId": "887E1D44-9739-40E1-8E9E-996FBE0CE823",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7\\(0.356\\):-:*:*:*:*:*:*",
                    "matchCriteriaId": "1002D75A-03DF-4958-8368-8F73F03C3E00",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7\\(0.903\\):*:*:*:*:*:*:*",
                    "matchCriteriaId": "8E0A5B82-0661-4F2F-932D-4BA3649EA62A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:-:*:*:*:*:*:*",
                    "matchCriteriaId": "1F22FABF-2831-4895-B0A9-283B98398F43",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch1:*:*:*:*:*:*",
                    "matchCriteriaId": "B83D0F20-5A43-4583-AFAF-CD9D20352437",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch2:*:*:*:*:*:*",
                    "matchCriteriaId": "2887A2C0-BADA-41D3-AA6A-F10BC58AA7F9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch3:*:*:*:*:*:*",
                    "matchCriteriaId": "5ADE32BD-C500-47D8-86D6-B08F55F1BBDF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch4:*:*:*:*:*:*",
                    "matchCriteriaId": "22F23314-96BE-42F6-AE07-CC13F8856029",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0\\(0.458\\):*:*:*:*:*:*:*",
                    "matchCriteriaId": "CDA8B438-3EAB-4383-B24B-22D08CB44EE5",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:-:*:*:*:*:*:*",
                    "matchCriteriaId": "A1063044-BCD7-487F-9880-141C30547E36",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch1:*:*:*:*:*:*",
                    "matchCriteriaId": "DA42E65A-7207-48B8-BE1B-0B352201BC09",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch2:*:*:*:*:*:*",
                    "matchCriteriaId": "75DDAF38-4D5F-4EE4-A428-68D28FC0DA96",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch3:*:*:*:*:*:*",
                    "matchCriteriaId": "C5FB6AA6-F8C9-48A6-BDDA-1D25C43564EB",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabilities, see the Details section of this advisory."
          },
          {
            "lang": "es",
            "value": "M\u00faltiples vulnerabilidades en la interfaz de administraci\u00f3n basada en web Cisco Identity Services Engine (ISE) Software podr\u00edan permitir a un atacante conducir un ataque de tipo cross-site scripting (XSS) contra un usuario de la interfaz. Para obtener m\u00e1s informaci\u00f3n sobre estas vulnerabilidades, consulte la secci\u00f3n Detalles de este aviso"
          }
        ],
        "id": "CVE-2021-34738",
        "lastModified": "2024-11-21T06:11:05.257",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "MEDIUM",
                "accessVector": "NETWORK",
                "authentication": "NONE",
                "availabilityImpact": "NONE",
                "baseScore": 4.3,
                "confidentialityImpact": "NONE",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 8.6,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": true
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "psirt@cisco.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.7,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2021-10-21T03:15:06.940",
        "references": [
          {
            "source": "psirt@cisco.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss1-rgxYry2V"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss1-rgxYry2V"
          }
        ],
        "sourceIdentifier": "psirt@cisco.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "psirt@cisco.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-79"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-03-27T13:54:43+00:00",
      "cve": "CVE-2021-34738",
      "id": "CVE-2021-34738",
      "initial_release_date": "2021-10-20T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Cisco Identity Services Engine Cross-Site Scripting Vulnerabilities",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-34738.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-04T00:19:48.193Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "name": "20211020 Cisco Identity Services Engine Cross-Site Scripting Vulnerabilities",
                "tags": [
                  "vendor-advisory",
                  "x_refsource_CISCO",
                  "x_transferred"
                ],
                "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss1-rgxYry2V"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2021-34738",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-11-07T21:40:00.942758Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-11-07T21:40:48.511Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "Cisco Identity Services Engine Software",
              "vendor": "Cisco",
              "versions": [
                {
                  "status": "affected",
                  "version": "n/a"
                }
              ]
            }
          ],
          "datePublic": "2021-10-20T00:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabilities, see the Details section of this advisory."
            }
          ],
          "exploits": [
            {
              "lang": "en",
              "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 6.1,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "CHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-79",
                  "description": "CWE-79",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2021-10-21T02:50:11.000Z",
            "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
            "shortName": "cisco"
          },
          "references": [
            {
              "name": "20211020 Cisco Identity Services Engine Cross-Site Scripting Vulnerabilities",
              "tags": [
                "vendor-advisory",
                "x_refsource_CISCO"
              ],
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss1-rgxYry2V"
            }
          ],
          "source": {
            "advisory": "cisco-sa-ise-xss1-rgxYry2V",
            "defect": [
              [
                "CSCvy11971",
                "CSCvy81868"
              ]
            ],
            "discovery": "INTERNAL"
          },
          "title": "Cisco Identity Services Engine Cross-Site Scripting Vulnerabilities",
          "x_legacyV4Record": {
            "CVE_data_meta": {
              "ASSIGNER": "psirt@cisco.com",
              "DATE_PUBLIC": "2021-10-20T16:00:00",
              "ID": "CVE-2021-34738",
              "STATE": "PUBLIC",
              "TITLE": "Cisco Identity Services Engine Cross-Site Scripting Vulnerabilities"
            },
            "affects": {
              "vendor": {
                "vendor_data": [
                  {
                    "product": {
                      "product_data": [
                        {
                          "product_name": "Cisco Identity Services Engine Software",
                          "version": {
                            "version_data": [
                              {
                                "version_value": "n/a"
                              }
                            ]
                          }
                        }
                      ]
                    },
                    "vendor_name": "Cisco"
                  }
                ]
              }
            },
            "data_format": "MITRE",
            "data_type": "CVE",
            "data_version": "4.0",
            "description": {
              "description_data": [
                {
                  "lang": "eng",
                  "value": "Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. For more information about these vulnerabilities, see the Details section of this advisory."
                }
              ]
            },
            "exploit": [
              {
                "lang": "en",
                "value": "The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
              }
            ],
            "impact": {
              "cvss": {
                "baseScore": "6.1",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
                "version": "3.0"
              }
            },
            "problemtype": {
              "problemtype_data": [
                {
                  "description": [
                    {
                      "lang": "eng",
                      "value": "CWE-79"
                    }
                  ]
                }
              ]
            },
            "references": {
              "reference_data": [
                {
                  "name": "20211020 Cisco Identity Services Engine Cross-Site Scripting Vulnerabilities",
                  "refsource": "CISCO",
                  "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss1-rgxYry2V"
                }
              ]
            },
            "source": {
              "advisory": "cisco-sa-ise-xss1-rgxYry2V",
              "defect": [
                [
                  "CSCvy11971",
                  "CSCvy81868"
                ]
              ],
              "discovery": "INTERNAL"
            }
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "assignerShortName": "cisco",
        "cveId": "CVE-2021-34738",
        "datePublished": "2021-10-21T02:50:11.767Z",
        "dateReserved": "2021-06-15T00:00:00.000Z",
        "dateUpdated": "2024-11-07T21:47:31.025Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.