This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Cisco Identity Services Engine fixes 2 vulnerabilities
Cisco fixes 2 vulnerabilities in the Identity Services Engine product with versions 3.1P9, 3.2P7 and 3.3P3 [1].
An authenticated remote attacker is allowed to carry out an XSS attack against users of the web interface [1].
The vulnerability is present in product:
- Cisco Identity Services Engine; <3.1P9; >=3.2, <3.2P7; >=3.3, <3.3P3;
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
More information:
- CVE-2024-20443 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 7. 8. 2024.
An authenticated remote attacker with administrator privileges is allowed to carry out an XSS attack against users of the web interface [1].
The vulnerability is present in product:
- Cisco Identity Services Engine; <3.1P9; >=3.2, <3.2P7; >=3.3, <3.3P3;
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
More information:
- CVE-2024-20479 at cve.org, NVD
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org
The vulnerability was publicly disclosed 7. 8. 2024.
By CESNET, z.s.p.o. Martin Krajči on 8. 8. 2024.