Vulnerability · Published Feb 19, 2020 · Assigned by cisco

CVE-2020-3156Cisco Identity Services Engine Cross-Site Scripting Vulnerability

Medium 6.1

In plain English

A medium-severity cross-site scripting in Cisco Identity Services Engine Software from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 65% of all known vulnerabilities).

Severity (CVSS 3.1)6.1Medium

Exploit odds (30 days)1.1%top 35.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in the logging component of Cisco Identity Services Engine could allow an unauthenticated remote attacker to conduct cross-site scripting attacks. The vulnerability is due to the improper validation of endpoint data stored in logs used by the web-based interface. An attacker could exploit this vulnerability by sending malicious endpoint data to the targeted system. An exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or to access sensitive, browser-based information.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco Identity Services Engine Software	unspecified – before n/a

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

20200219 Cisco Identity Services Engine Cross-Site Scripting Vulnerability vendor-advisory, x_refsource_CISCO