CVE-2013-5523: Input Validation
First published: Thu Oct 10 2013(Updated: )
The Sponsor Portal in Cisco Identity Services Engine (ISE) 1.2 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCui82666.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Identity Services Engine | <=1.2 | |
| Cisco Identity Services Engine | =1.0 | |
| Cisco Identity Services Engine | =1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://osvdb.org/98168
- http://secunia.com/advisories/55207
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5523
- http://tools.cisco.com/security/center/viewAlert.x?alertId=31161
- http://www.securityfocus.com/bid/62869
- http://www.securitytracker.com/id/1029157
- https://exchange.xforce.ibmcloud.com/vulnerabilities/87724
Frequently Asked Questions
What is the severity of CVE-2013-5523?
CVE-2013-5523 is considered to have a medium severity level due to the potential for clickjacking attacks.
How do I fix CVE-2013-5523?
To fix CVE-2013-5523, upgrade to a version of Cisco Identity Services Engine later than 1.2.
What is the impact of CVE-2013-5523?
The impact of CVE-2013-5523 includes the risk of unauthorized actions being taken on behalf of users due to clickjacking vulnerabilities.
Which versions of Cisco Identity Services Engine are affected by CVE-2013-5523?
CVE-2013-5523 affects Cisco Identity Services Engine versions 1.0, 1.1, and 1.2 and earlier.
Is there a workaround for CVE-2013-5523?
There are no specific workarounds for CVE-2013-5523, and upgrading to a patched version is recommended.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/severity
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco identity services engine
- version/cisco identity services engine/1.2
- version/cisco identity services engine/1.0
- version/cisco identity services engine/1.1