CVE-2022-20966

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-20966
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conduct cross-site scripting attacks against other users of the application web-based management interface. This vulnerability is due to improper validation of input to an application feature before storage within the web-based management interface. An attacker could exploit this vulnerability by creating entries within the application interface that contain malicious HTML or script code. A successful exploit could allow the attacker to store malicious HTML or script code within the application interface for use in further cross-site scripting attacks. Cisco has not yet released software updates that address this vulnerability.

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-7Q4TNYUx Vendor Advisory
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-7Q4TNYUx Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.6.0:-:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch1:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch10:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch11:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch12:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch2:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch3:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch5:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch6:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch7:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch8:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch9:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.7.0:-:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch1:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch2:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch3:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch4:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch5:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch6:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch7:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:3.0.0:-:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch1:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch2:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch3:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch4:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch5:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch6:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:3.1:-:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:3.1:patch1:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:3.1:patch3:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:3.1:patch4:*:*:*:*:*:*
cpe:2.3:a:cisco:identity_services_engine:3.2:-:*:*:*:*:*:*
History

21 Nov 2024, 06:43

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad en la interfaz de administración basada en web de Cisco Identity Services Engine podría permitir que un atacante remoto autenticado realice ataques de cross-site scripting contra otros usuarios de la interfaz de administración basada en web de la aplicación. Esta vulnerabilidad se debe a una validación inadecuada de la entrada a una función de la aplicación antes del almacenamiento dentro de la interfaz de administración basada en web. Un atacante podría aprovechar esta vulnerabilidad creando entradas dentro de la interfaz de la aplicación que contengan código HTML o script malicioso. Un exploit exitoso podría permitir al atacante almacenar código HTML o script malicioso dentro de la interfaz de la aplicación para usarlo en futuros ataques de scripts entre sitios. Cisco aún no ha publicado actualizaciones de software que aborden esta vulnerabilidad.
References () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-7Q4TNYUx - Vendor Advisory () https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-7Q4TNYUx - Vendor Advisory

25 Jan 2024, 17:15

Type Values Removed Values Added
References
  • {'url': 'https://yoroi.company/en/research/cve-advisory-full-disclosure-cisco-ise-multiple-vulnerabilities-rce-with-1-click/', 'name': 'https://yoroi.company/en/research/cve-advisory-full-disclosure-cisco-ise-multiple-vulnerabilities-rce-with-1-click/', 'tags': [], 'refsource': ''}

16 Jan 2024, 22:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-01-20 07:15

Updated : 2024-11-21 06:43

NVD link : CVE-2022-20966

Mitre link : CVE-2022-20966

CVE.ORG link : CVE-2022-20966

JSON object : View

Products Affected

cisco

  • identity_services_engine
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')