Cisco Identity Services Engine Cross Site Scripting and HTML-injection Vulnerabilities

Cisco Identity Services Engine is prone to a cross-site scripting vulnerability and an HTML-injection vulnerability.

An attacker can exploit these vulnerabilities to execute arbitrary HTML script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or perform unauthorized actions. Other attacks are also possible.

This issue being tracked by Cisco Bug ID's CSCvm71860 and CSCvm79609.


Bugtraq ID: 106513
Class: Input Validation Error
CVE: CVE-2018-15440

Remote: Yes
Local: No
Published: Jan 09 2019 12:00AM
Updated: Jan 09 2019 12:00AM
Credit: Pedro Ribeiro and Olivier Arteau of Groupe Technologie Desjardins.
Vulnerable: Cisco Identity Services Engine 2.4(0.357)
Cisco Identity Services Engine 0

Not Vulnerable:


To exploit these issues, an attacker must entice an unsuspecting victim to follow a malicious URI or visit a malicious website.

Related Posts