CVE-2017-6734

Опубликовано: 10 июл. 2017

Источник: nvd

CVSS3: 5.4

CVSS2: 3.5

EPSS Низкий

Описание

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of an affected device, related to the Guest Portal. More Information: CSCvd74794. Known Affected Releases: 1.3(0.909) 2.1(0.800).

Ссылки

http://www.securityfocus.com/bid/99459
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1038823
Third Party Advisory
VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-ise2
Vendor Advisory
http://www.securityfocus.com/bid/99459
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1038823
Third Party Advisory
VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170705-ise2
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cisco:identity_services_engine:1.3\(0.722\):*:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:1.3\(0.876\):*:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:1.3\(0.909\):*:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:1.3\(106.146\):*:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:1.3\(120.135\):*:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.1\(0.474\):*:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.1\(0.800\):*:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.1\(102.101\):*:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.1_base:*:*:*:*:*:*:*

EPSS

Процентиль: 46%

0.00235

Низкий

5.4 Medium

CVSS3

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-8wc6-rqwr-64qg