Vulnerability Details CVE-2022-20959
A vulnerability in the External RESTful Services (ERS) API of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by persuading an authenticated administrator of the web-based management interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.001
EPSS Ranking 29.4%
CVSS Severity
CVSS v3 Score 6.1
References
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-twLnpy3M
- https://yoroi.company/en/research/cve-advisory-full-disclosure-cisco-ise-cross-site-scripting/
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-twLnpy3M
- https://yoroi.company/en/research/cve-advisory-full-disclosure-cisco-ise-cross-site-scripting/
Products affected by CVE-2022-20959
-
cpe:2.3:a:cisco:identity_services_engine:002.004(000.911)
-
cpe:2.3:a:cisco:identity_services_engine:002.004(000.914)
-
cpe:2.3:a:cisco:identity_services_engine:002.006(000.156)
-
cpe:2.3:a:cisco:identity_services_engine:002.006(000.902)
-
cpe:2.3:a:cisco:identity_services_engine:002.007(000.356)
-
cpe:2.3:a:cisco:identity_services_engine:2.4
-
cpe:2.3:a:cisco:identity_services_engine:2.4(0.192)
-
cpe:2.3:a:cisco:identity_services_engine:2.4(0.247)
-
cpe:2.3:a:cisco:identity_services_engine:2.4(0.357)
-
cpe:2.3:a:cisco:identity_services_engine:2.4(0.901)
-
cpe:2.3:a:cisco:identity_services_engine:2.4(0.901.1)
-
cpe:2.3:a:cisco:identity_services_engine:2.4(0.902)
-
cpe:2.3:a:cisco:identity_services_engine:2.4(0.903)
-
cpe:2.3:a:cisco:identity_services_engine:2.4(0.904)
-
cpe:2.3:a:cisco:identity_services_engine:2.4(100.159)
-
cpe:2.3:a:cisco:identity_services_engine:2.4.0
-
cpe:2.3:a:cisco:identity_services_engine:2.4.0.357
-
cpe:2.3:a:cisco:identity_services_engine:2.5
-
cpe:2.3:a:cisco:identity_services_engine:2.5(0.1)
-
cpe:2.3:a:cisco:identity_services_engine:2.5(0.225)
-
cpe:2.3:a:cisco:identity_services_engine:2.5(0.353)
-
cpe:2.3:a:cisco:identity_services_engine:2.6
-
cpe:2.3:a:cisco:identity_services_engine:2.6(0.156)
-
cpe:2.3:a:cisco:identity_services_engine:2.6(0.999)
-
cpe:2.3:a:cisco:identity_services_engine:2.6.0
-
cpe:2.3:a:cisco:identity_services_engine:2.6.0.156
-
cpe:2.3:a:cisco:identity_services_engine:2.7
-
cpe:2.3:a:cisco:identity_services_engine:2.7(0.207)
-
cpe:2.3:a:cisco:identity_services_engine:2.7(0.356)
-
cpe:2.3:a:cisco:identity_services_engine:2.7(0.903)
-
cpe:2.3:a:cisco:identity_services_engine:2.7.0
-
cpe:2.3:a:cisco:identity_services_engine:3.0.0
-
cpe:2.3:a:cisco:identity_services_engine:3.1
-
cpe:2.3:a:cisco:identity_services_engine:3.2