CVE-2019-1673: Cisco Identity Services Engine Cross-Site Scripting Vulnerability
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient input validation of some parameters passed to the web-based management interface. An attacker could exploit this vulnerability by convincing a user of the interface to click a specific link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. For information about fixed software releases, consult the Cisco bug ID at https://quickview.cloudapps.cisco.com/quickview/bug/CSCvn64652. When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories and Alerts page, to determine exposure and a complete upgrade solution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-1673?
CVE-2019-1673 has a medium severity rating due to its potential for enabling cross-site scripting attacks.
How do I fix CVE-2019-1673?
To fix CVE-2019-1673, update the Cisco Identity Services Engine to the latest version provided by Cisco.
Who is affected by CVE-2019-1673?
CVE-2019-1673 affects users of the Cisco Identity Services Engine version 2.5(0.353).
What type of vulnerability is CVE-2019-1673?
CVE-2019-1673 is classified as a cross-site scripting (XSS) vulnerability.
Can CVE-2019-1673 be exploited remotely?
Yes, CVE-2019-1673 can be exploited remotely by an authenticated attacker.