CVE-2013-5523: Input Validation
The Sponsor Portal in Cisco Identity Services Engine (ISE) 1.2 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCui82666.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-5523?
CVE-2013-5523 is considered to have a medium severity level due to the potential for clickjacking attacks.
How do I fix CVE-2013-5523?
To fix CVE-2013-5523, upgrade to a version of Cisco Identity Services Engine later than 1.2.
What is the impact of CVE-2013-5523?
The impact of CVE-2013-5523 includes the risk of unauthorized actions being taken on behalf of users due to clickjacking vulnerabilities.
Which versions of Cisco Identity Services Engine are affected by CVE-2013-5523?
CVE-2013-5523 affects Cisco Identity Services Engine versions 1.0, 1.1, and 1.2 and earlier.
Is there a workaround for CVE-2013-5523?
There are no specific workarounds for CVE-2013-5523, and upgrading to a patched version is recommended.