CVE-2024-20251: XSS
Published Jan 17, 2024
·Updated
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack against a user of the interface on an affected device. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Affected Software
208 affected components
Cisco Identity Services Engine=1.0
Cisco Identity Services Engine=1.0.4
Cisco Identity Services Engine=1.1
Cisco Identity Services Engine=1.1.1
Cisco Identity Services Engine=1.1.2
Cisco Identity Services Engine=1.1.3
Cisco Identity Services Engine=1.1.4
Cisco Identity Services Engine=1.2
Cisco Identity Services Engine=1.2\(1.199\)
Cisco Identity Services Engine=1.2.1
Cisco Identity Services Engine=1.3
Cisco Identity Services Engine=1.3\(0.722\)
Cisco Identity Services Engine=1.3\(0.876\)
Cisco Identity Services Engine=1.3\(0.909\)
Cisco Identity Services Engine=1.3\(106.146\)
Cisco Identity Services Engine=1.3\(120.135\)
Cisco Identity Services Engine=1.4
Cisco Identity Services Engine=1.4\(0.109\)
Cisco Identity Services Engine=1.4\(0.181\)
Cisco Identity Services Engine=1.4\(0.253\)
Cisco Identity Services Engine=1.4\(0.908\)
Cisco Identity Services Engine=2.0
Cisco Identity Services Engine=2.0\(0.147\)
Cisco Identity Services Engine=2.0\(0.169\)
Cisco Identity Services Engine=2.0\(0.222\)
Cisco Identity Services Engine=2.0\(0.234\)
Cisco Identity Services Engine=2.0\(0.249\)
Cisco Identity Services Engine=2.0\(0.306\)
Cisco Identity Services Engine=2.0\(1.130\)
Cisco Identity Services Engine=2.0.1
Cisco Identity Services Engine=2.1
Cisco Identity Services Engine=2.1\(0.474\)
Cisco Identity Services Engine=2.1\(0.476\)
Cisco Identity Services Engine=2.1\(0.800\)
Cisco Identity Services Engine=2.1\(0.904\)
Cisco Identity Services Engine=2.1\(0.907\)
Cisco Identity Services Engine=2.1\(102.101\)
Cisco Identity Services Engine=2.1\(102.103\)
Cisco Identity Services Engine=2.2
Cisco Identity Services Engine=2.2\(0.283\)
Cisco Identity Services Engine=2.2\(0.470\)
Cisco Identity Services Engine=2.2\(0.471\)
Cisco Identity Services Engine=2.2\(0.903\)
Cisco Identity Services Engine=2.2\(0.909\)
Cisco Identity Services Engine=2.2\(0.910\)
Cisco Identity Services Engine=2.2\(1.145\)
Cisco Identity Services Engine=2.2.0
Cisco Identity Services Engine=2.2.0-patch1
Cisco Identity Services Engine=2.2.0-patch10
Cisco Identity Services Engine=2.2.0-patch12
Cisco Identity Services Engine=2.2.0-patch13
Cisco Identity Services Engine=2.2.0-patch14
Cisco Identity Services Engine=2.2.0-patch15
Cisco Identity Services Engine=2.2.0-patch16
Cisco Identity Services Engine=2.2.0-patch17
Cisco Identity Services Engine=2.2.0-patch2
Cisco Identity Services Engine=2.2.0-patch3
Cisco Identity Services Engine=2.2.0-patch4
Cisco Identity Services Engine=2.2.0-patch5
Cisco Identity Services Engine=2.2.0-patch6
Cisco Identity Services Engine=2.2.0-patch7
Cisco Identity Services Engine=2.2.0-patch8
Cisco Identity Services Engine=2.2.0-patch9
Cisco Identity Services Engine=2.2.0.470
Cisco Identity Services Engine=2.2.0.470-patch1
Cisco Identity Services Engine=2.2.0.470-patch10
Cisco Identity Services Engine=2.2.0.470-patch11
Cisco Identity Services Engine=2.2.0.470-patch12
Cisco Identity Services Engine=2.2.0.470-patch13
Cisco Identity Services Engine=2.2.0.470-patch14
Cisco Identity Services Engine=2.2.0.470-patch15
Cisco Identity Services Engine=2.2.0.470-patch16
Cisco Identity Services Engine=2.2.0.470-patch2
Cisco Identity Services Engine=2.2.0.470-patch3
Cisco Identity Services Engine=2.2.0.470-patch4
Cisco Identity Services Engine=2.2.0.470-patch5
Cisco Identity Services Engine=2.2.0.470-patch6
Cisco Identity Services Engine=2.2.0.470-patch7
Cisco Identity Services Engine=2.2.0.470-patch8
Cisco Identity Services Engine=2.2.0.470-patch9
Cisco Identity Services Engine=2.3
Cisco Identity Services Engine=2.3\(0.151\)
Cisco Identity Services Engine=2.3\(0.298\)
Cisco Identity Services Engine=2.3\(0.904\)
Cisco Identity Services Engine=2.3\(0.905\)
Cisco Identity Services Engine=2.3.0
Cisco Identity Services Engine=2.3.0-patch1
Cisco Identity Services Engine=2.3.0-patch2
Cisco Identity Services Engine=2.3.0-patch3
Cisco Identity Services Engine=2.3.0-patch4
Cisco Identity Services Engine=2.3.0-patch5
Cisco Identity Services Engine=2.3.0-patch6
Cisco Identity Services Engine=2.3.0-patch7
Cisco Identity Services Engine=2.3.0.298
Cisco Identity Services Engine=2.3.0.298-patch1
Cisco Identity Services Engine=2.3.0.298-patch2
Cisco Identity Services Engine=2.3.0.298-patch3
Cisco Identity Services Engine=2.3.0.298-patch4
Cisco Identity Services Engine=2.3.0.298-patch5
Cisco Identity Services Engine=2.3.0.298-patch6
Cisco Identity Services Engine=2.3.0.298-patch7
Cisco Identity Services Engine=2.4
Cisco Identity Services Engine=2.4\(0.192\)
Cisco Identity Services Engine=2.4\(0.247\)
Cisco Identity Services Engine=2.4\(0.357\)
Cisco Identity Services Engine=2.4\(0.901\)
Cisco Identity Services Engine=2.4\(0.901.1\)
Cisco Identity Services Engine=2.4\(0.902\)
Cisco Identity Services Engine=2.4\(0.903\)
Cisco Identity Services Engine=2.4\(0.904\)
Cisco Identity Services Engine=002.004\(000.914\)
Cisco Identity Services Engine=2.4\(100.159\)
Cisco Identity Services Engine=2.4.0
Cisco Identity Services Engine=2.4.0-patch_11
Cisco Identity Services Engine=2.4.0-patch1
Cisco Identity Services Engine=2.4.0-patch10
Cisco Identity Services Engine=2.4.0-patch11
Cisco Identity Services Engine=2.4.0-patch12
Cisco Identity Services Engine=2.4.0-patch13
Cisco Identity Services Engine=2.4.0-patch14
Cisco Identity Services Engine=2.4.0-patch2
Cisco Identity Services Engine=2.4.0-patch3
Cisco Identity Services Engine=2.4.0-patch4
Cisco Identity Services Engine=2.4.0-patch5
Cisco Identity Services Engine=2.4.0-patch6
Cisco Identity Services Engine=2.4.0-patch7
Cisco Identity Services Engine=2.4.0-patch8
Cisco Identity Services Engine=2.4.0-patch9
Cisco Identity Services Engine=2.4.0.357
Cisco Identity Services Engine=2.4.0.357-patch1
Cisco Identity Services Engine=2.4.0.357-patch10
Cisco Identity Services Engine=2.4.0.357-patch11
Cisco Identity Services Engine=2.4.0.357-patch12
Cisco Identity Services Engine=2.4.0.357-patch2
Cisco Identity Services Engine=2.4.0.357-patch3
Cisco Identity Services Engine=2.4.0.357-patch4
Cisco Identity Services Engine=2.4.0.357-patch5
Cisco Identity Services Engine=2.4.0.357-patch6
Cisco Identity Services Engine=2.4.0.357-patch7
Cisco Identity Services Engine=2.4.0.357-patch8
Cisco Identity Services Engine=2.4.0.357-patch9
Cisco Identity Services Engine=2.5
Cisco Identity Services Engine=2.5\(0.1\)
Cisco Identity Services Engine=2.5\(0.225\)
Cisco Identity Services Engine=2.5\(0.353\)
Cisco Identity Services Engine=2.6
Cisco Identity Services Engine=2.6\(0.156\)
Cisco Identity Services Engine=002.006\(000.156\)
Cisco Identity Services Engine=2.6\(0.999\)
Cisco Identity Services Engine=2.6.0
Cisco Identity Services Engine=2.6.0-patch1
Cisco Identity Services Engine=2.6.0-patch10
Cisco Identity Services Engine=2.6.0-patch11
Cisco Identity Services Engine=2.6.0-patch12
Cisco Identity Services Engine=2.6.0-patch2
Cisco Identity Services Engine=2.6.0-patch3
Cisco Identity Services Engine=2.6.0-patch4
Cisco Identity Services Engine=2.6.0-patch5
Cisco Identity Services Engine=2.6.0-patch6
Cisco Identity Services Engine=2.6.0-patch7
Cisco Identity Services Engine=2.6.0-patch8
Cisco Identity Services Engine=2.6.0-patch9
Cisco Identity Services Engine=2.6.0.156-patch1
Cisco Identity Services Engine=2.6.0.156-patch2
Cisco Identity Services Engine=2.6.0.156-patch3
Cisco Identity Services Engine=2.6.0.156-patch5
Cisco Identity Services Engine=2.6.0.156-patch6
Cisco Identity Services Engine=2.6.0.156-patch7
Cisco Identity Services Engine=2.7
Cisco Identity Services Engine=2.7\(0.207\)
Cisco Identity Services Engine=2.7\(0.356\)
Cisco Identity Services Engine=2.7\(0.356\)
Cisco Identity Services Engine=002.007\(000.356\)
Cisco Identity Services Engine=2.7\(0.903\)
Cisco Identity Services Engine=2.7.0
Cisco Identity Services Engine=2.7.0-patch1
Cisco Identity Services Engine=2.7.0-patch2
Cisco Identity Services Engine=2.7.0-patch3
Cisco Identity Services Engine=2.7.0-patch4
Cisco Identity Services Engine=2.7.0-patch5
Cisco Identity Services Engine=2.7.0-patch6
Cisco Identity Services Engine=2.7.0-patch7
Cisco Identity Services Engine=2.7.0-patch8
Cisco Identity Services Engine=2.7.0-patch9
Cisco Identity Services Engine=2.7.0.356-patch1
Cisco Identity Services Engine=3.0\(0.458\)
Cisco Identity Services Engine=003.000\(000.458\)
Cisco Identity Services Engine=3.0.0
Cisco Identity Services Engine=3.0.0-patch1
Cisco Identity Services Engine=3.0.0-patch2
Cisco Identity Services Engine=3.0.0-patch3
Cisco Identity Services Engine=3.0.0-patch4
Cisco Identity Services Engine=3.0.0-patch5
Cisco Identity Services Engine=3.0.0-patch6
Cisco Identity Services Engine=3.0.0-patch7
Cisco Identity Services Engine=3.1
Cisco Identity Services Engine=3.1-patch1
Cisco Identity Services Engine=3.1-patch2
Cisco Identity Services Engine=3.1-patch3
Cisco Identity Services Engine=3.1-patch4
Cisco Identity Services Engine=3.1-patch5
Cisco Identity Services Engine=3.1-patch6
Cisco Identity Services Engine=3.1-patch7
Cisco Identity Services Engine=3.2
Cisco Identity Services Engine=3.2-patch1
Cisco Identity Services Engine=3.2-patch2
Cisco Identity Services Engine=3.2-patch3
Cisco Identity Services Engine=3.2-patch4
Event History
Jan 17, 2024
CVE Published
via MITRE·04:55 PM
Data Sourced
via MITRE·04:55 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2024-20251?
CVE-2024-20251 is rated as high severity due to its potential to allow authenticated attackers to execute stored cross-site scripting attacks.
2
How do I fix CVE-2024-20251?
To fix CVE-2024-20251, upgrade to the latest version of Cisco Identity Services Engine which addresses this vulnerability.
3
What products are affected by CVE-2024-20251?
CVE-2024-20251 affects multiple versions of Cisco Identity Services Engine including versions 1.0, 1.1, 1.2, 1.3, 1.4, 2.0, and 2.1 through 2.7.
4
What type of attack can be executed using CVE-2024-20251?
CVE-2024-20251 allows an attacker to conduct a stored cross-site scripting (XSS) attack against users of the affected web-based management interface.
5
Is user authentication required to exploit CVE-2024-20251?
Yes, an attacker must be authenticated to exploit CVE-2024-20251 and perform the stored XSS attack.