Cisco Identity Services Engine Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the web-based management interface of Cisco Identity Services Engine (ISE). This issue allows authenticated, remote attackers to inject malicious scripts into specific pages of the interface. The vulnerability arises from inadequate validation of user input, enabling attackers to execute arbitrary scripts in the context of the affected interface or access sensitive browser-based information. Exploitation requires valid administrative credentials.

Impact

Successful exploitation allows for cross-site scripting attacks, where an attacker can inject and execute malicious scripts in the context of the user's session.

Remediation

Cisco has released software updates to address this vulnerability. Instructions for upgrading can be found in the Cisco Identity Services Engine Upgrade Guides. Users should consult the Cisco Security Advisories page for information on fixed releases.