Cisco ISE and ISE-PIC Stored Cross-Site Scripting Vulnerability

A stored cross-site scripting vulnerability has been identified in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-PIC). This vulnerability allows an authenticated, remote attacker to inject malicious code into specific pages of the interface, which could then be executed in the context of the affected user. The vulnerability arises from insufficient validation of user-supplied input, and exploitation requires at least a low-privileged account on the affected device.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user interface.

Remediation

Cisco has released software updates to address this vulnerability. Instructions for upgrading can be found on the Cisco Identity Services Engine support page.