Vulnerability · Published Jan 18, 2023 · Assigned by cisco
CVE-2022-20966
Medium 5.4
In plain English
A medium-severity cross-site scripting in Cisco Identity Services Engine Software from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 27.6% (higher than 98% of all known vulnerabilities).
Official description
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conduct cross-site scripting attacks against other users of the application web-based management interface. This vulnerability is due to improper validation of input to an application feature before storage within the web-based management interface. An attacker could exploit this vulnerability by creating entries within the application interface that contain malicious HTML or script code. A successful exploit could allow the attacker to store malicious HTML or script code within the application interface for use in further cross-site scripting attacks. Cisco has not yet released software updates that address this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Identity Services Engine Software | 2.6.02.6.0 p12.6.0 p22.6.0 p32.6.0 p52.6.0 p62.6.0 p72.6.0 p8 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N