Cisco ISE and ISE-PIC Reflected Cross-Site Scripting Vulnerability

A reflected cross-site scripting vulnerability has been identified in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). This vulnerability allows an authenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. The issue arises from insufficient validation of user-supplied input, enabling attackers to inject malicious code into specific pages. Exploitation could result in the execution of arbitrary script code in the context of the affected interface or access to sensitive, browser-based information.

Impact

Exploitation of this vulnerability allows for reflected cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Cisco has released software updates to address this vulnerability. Instructions for upgrading can be found on the Cisco Identity Services Engine support page.