CVE-2022-20966

Опубликовано: 20 янв. 2023

Источник: nvd

CVSS3: 5.4

EPSS Низкий

Описание

This vulnerability is due to improper validation of input to an application feature before storage within the web-based management interface. An attacker could exploit this vulnerability by creating entries within the application interface that contain malicious HTML or script code. A successful exploit could allow the attacker to store malicious HTML or script code within the application interface for use in further cross-site scripting attacks.

Cisco has not yet released software updates that address this vulnerability.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*

Версия до 2.6.0 (исключая)

cpe:2.3:a:cisco:identity_services_engine:2.6.0:-:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch1:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch10:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch11:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch12:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch2:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch3:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch5:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch6:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch7:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch8:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch9:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.7.0:-:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch1:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch2:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch3:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch4:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch5:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch6:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch7:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.0.0:-:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch1:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch2:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch3:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch4:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch5:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch6:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.1:-:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.1:patch1:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.1:patch3:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.1:patch4:*:*:*:*:*:*

cpe:2.3:a:cisco:identity_services_engine:3.2:-:*:*:*:*:*:*

EPSS

Процентиль: 84%

0.02154

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-4xm9-j87c-v95w

CVSS3: 5.4

github

около 3 лет назад

A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conduct cross-site scripting attacks against other users of the application web-based management interface. This vulnerability is due to improper validation of input to an application feature before storage within the web-based management interface. An attacker could exploit this vulnerability by creating entries within the application interface that contain malicious HTML or script code. A successful exploit could allow the attacker to store malicious HTML or script code within the application interface for use in further cross-site scripting attacks. Cisco has not yet released software updates that address this vulnerability.

BDU:2022-07124

CVSS3: 5.4

fstec

около 3 лет назад

Уязвимость веб-интерфейса управления платформы управления политиками соединений Cisco Identity Services Engine (ISE), позволяющая нарушителю осуществлять межсайтовые сценарные атаки

EPSS

Процентиль: 84%

0.02154

Низкий

5.4 Medium

CVSS3

Дефекты

CWE-79