CVE-2019-15281

Published Oct 16, 2019

Last updated 5 years ago

CVSS medium 4.8

Overview

Description: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The attacker must have valid administrator credentials. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by injecting malicious code into a troubleshooting file. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Source: ykramarz@cisco.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.8
Impact score: 2.7
Exploitability score: 1.7
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

CVSS 3.0

Type: Secondary
Base score: 4.8
Impact score: 2.7
Exploitability score: 1.7
Vector string: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

CVSS 2.0

Type: Primary
Base score: 3.5
Impact score: 2.9
Exploitability score: 6.8
Vector string: AV:N/AC:M/Au:S/C:N/I:P/A:N

Weaknesses

nvd@nist.gov: CWE-79
ykramarz@cisco.com: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:cisco:identity_services_engine_software:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "ECC9CF6C-838C-4C7F-8944-4F0736875207",
            "versionEndExcluding": "2.4\\(0.357\\)"
          },
          {
            "criteria": "cpe:2.3:a:cisco:identity_services_engine_software:2.4\\(0.357\\):-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "530BF3D8-E256-4ADB-B0CB-6970885D65AD"
          },
          {
            "criteria": "cpe:2.3:a:cisco:identity_services_engine_software:2.4\\(0.357\\):patch1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B2FC1F25-BFCE-4EDF-A663-F9A3DB2CBB30"
          },
          {
            "criteria": "cpe:2.3:a:cisco:identity_services_engine_software:2.4\\(0.357\\):patch2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "22165A20-D544-4C98-9A6A-5FC0E635668B"
          },
          {
            "criteria": "cpe:2.3:a:cisco:identity_services_engine_software:2.4\\(0.357\\):patch3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0059B8B5-5168-4A16-93EA-C959AADF6929"
          },
          {
            "criteria": "cpe:2.3:a:cisco:identity_services_engine_software:2.4\\(0.357\\):patch4:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "094F2C84-FF31-4C16-928B-8B55057125F6"
          },
          {
            "criteria": "cpe:2.3:a:cisco:identity_services_engine_software:2.4\\(0.357\\):patch5:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "573A629A-0747-4146-955A-AE3198A33103"
          },
          {
            "criteria": "cpe:2.3:a:cisco:identity_services_engine_software:2.4\\(0.357\\):patch6:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A2AA30CC-A4D1-477D-9AD5-BFD2C1A91C02"
          },
          {
            "criteria": "cpe:2.3:a:cisco:identity_services_engine_software:2.4\\(0.357\\):patch7:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E4EF10D4-BA24-46F8-9FFD-95DDFBFEB919"
          },
          {
            "criteria": "cpe:2.3:a:cisco:identity_services_engine_software:2.4\\(0.357\\):patch8:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "71BBA48D-FCDC-4096-AF12-981F17E28815"
          },
          {
            "criteria": "cpe:2.3:a:cisco:identity_services_engine_software:2.4\\(0.357\\):patch9:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "26F5B643-6971-40D7-BF81-81CC3FE6A16D"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

CVSS 3.0

CVSS 2.0

Weaknesses

Social media

Configurations

References