Cisco Identity Services Engine 2.1 Web-based Management Interface cross site scripting

Summaryinfo

A vulnerability identified as problematic has been detected in Cisco Identity Services Engine 2.1. Affected by this vulnerability is an unknown functionality of the component Web-based Management Interface. The manipulation leads to cross site scripting. This vulnerability is listed as CVE-2019-1719. The attack may be initiated remotely. There is no available exploit.

Detailsinfo

A vulnerability was found in Cisco Identity Services Engine 2.1 (Policy Management Software). It has been rated as problematic. This issue affects some unknown functionality of the component Web-based Management Interface. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. The summary by CVE is:

A vulnerability in the web-based guest portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface. The vulnerability is due to insufficient validation of user-supplied input that is processed by the web-based interface. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information. Cisco ISE software version 2.1 is affected.

The bug was discovered 04/17/2019. The weakness was presented 04/18/2019 (Website). The advisory is shared at securityfocus.com. The identification of this vulnerability is CVE-2019-1719 since 12/06/2018. The attack may be initiated remotely. A simple authentication is required for exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 09/04/2023). MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $5k-$25k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-133792 for similar entry. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Policy Management Software

Vendor

• Cisco

Name

• Identity Services Engine

Version

• 2.1

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion