PT-2022-5724 · Cisco · Cisco Identity Services Engine

Published 2022-11-16 · Updated 2024-01-25 · CVE-2022-20967

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Identity Services Engine (affected versions not specified)

Description A vulnerability in the web-based management interface could allow an authenticated, remote attacker to conduct cross-site scripting attacks against other users of the application. This issue is due to improper validation of input to an application feature before storage within the web-based management interface. An attacker could exploit this by creating entries within the application interface that contain malicious HTML or script code, allowing the storage of malicious code for further cross-site scripting attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation. Avoid using the interface to store or process unvalidated input until the issue is resolved.

XSS

OS Command Injection

Weakness Enumeration

CWE-79

CWE-78

Related Identifiers

BDU:2022-07122

CVE-2022-20967

Affected Products

Cisco Identity Services Engine

References · 8

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-7Q4TNYUx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20967 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20967 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-07122 · Security Note
• https://t.me/true_secator/3755 · Telegram Post
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-7Q4TNYUx · Note
• https://vuldb.com/?id.213798 · Note
• https://t.me/cvenotify/42530 · Telegram Post