Alexander Polce Leary

**Name of the Vulnerable Software and Affected Versions** Cisco Identity Services Engine (ISE) Software (affected versions not specified) **Description** The issue exists due to insufficient protection of the web page structure in the Cisco Identity Services Engine platform's web interface. This could allow a remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Identity Services Engine (ISE) (affected versions not specified) **Description** A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker with administrative read-only privileges to download files that should be restricted. This issue is due to incorrect permissions settings on an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request to the device. A successful exploit could allow the attacker to download files that should be restricted. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Identity Services Engine (affected versions not specified) **Description** The issue is related to insufficient input validation for specific API endpoints in the REST API of Cisco Identity Services Engine. This could allow a remote attacker to perform a command injection attack and elevate privileges to root. An attacker in a man-in-the-middle position could exploit this by intercepting and modifying specific internode communications from one ISE persona to another. A successful exploit could allow the attacker to run arbitrary commands with root privileges on the underlying operating system. To exploit this, the attacker would need to decrypt HTTPS traffic between two ISE personas located on separate nodes. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Identity Services Engine (ISE) (affected versions not specified) **Description** The web-based management interface of Cisco Identity Services Engine (ISE) has multiple vulnerabilities that could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user. These vulnerabilities exist because the web-based management interface does not sufficiently validate user-supplied input. An attacker could exploit these vulnerabilities by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit these vulnerabilities, the attacker would need valid administrative credentials. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.