Maksim Tsoy

**Name of the Vulnerable Software and Affected Versions** Cisco Identity Services Engine (ISE) versions prior to 1.1.0.665 Cumulative Patch 1 **Description** The issue affects the ISE Administrator user interface, also known as the Apache Tomcat interface, on Cisco Identity Services Engine (ISE) 3300 series appliances. It involves multiple cross-site request forgery (CSRF) vulnerabilities that allow remote attackers to hijack the authentication of administrators. **Recommendations** For versions prior to 1.1.0.665 Cumulative Patch 1, apply Cumulative Patch 1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Cisco Secure Access Control Server (ACS) version 5.2 **Description** The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities in the Solution Engine. These vulnerabilities allow remote attackers to hijack the authentication of administrators for requests that insert cross-site scripting (XSS) sequences. **Recommendations** For Cisco Secure Access Control Server (ACS) version 5.2, consider disabling the Solution Engine as a temporary workaround until a patch is available. Restrict access to administrative functions to minimize the risk of exploitation. Avoid using the Solution Engine for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Secure Access Control Server (ACS) version 5.2 **Description** The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the Solution Engine of Cisco Secure Access Control Server (ACS). These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. **Recommendations** For Cisco Secure Access Control Server (ACS) version 5.2, update to a version that includes the fix for Bug ID CSCtr78192 to resolve the issue. As a temporary workaround, consider restricting access to the Solution Engine to minimize the risk of exploitation.