A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface.
This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials.
This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Cisco |
|
Configuration 1 [-]
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2025-16017 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials. |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Tue, 22 Jul 2025 16:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Cisco
Cisco identity Services Engine |
|
| CPEs | cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.2.0:-:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch1:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch2:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch3:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch4:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch5:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch6:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.2.0:patch7:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:-:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch1:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch2:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch3:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.3.0:patch4:*:*:*:*:*:* cpe:2.3:a:cisco:identity_services_engine:3.4.0:-:*:*:*:*:*:* |
|
| Vendors & Products |
Cisco
Cisco identity Services Engine |
Wed, 21 May 2025 20:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 21 May 2025 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker must have valid administrative credentials. | |
| Title | Cisco Identity Services Stored Cross-Site Scripting Vulnerability | |
| Weaknesses | CWE-80 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: cisco
Published:
Updated: 2025-05-21T19:52:30.840Z
Reserved: 2024-10-10T19:15:13.244Z
Link: CVE-2025-20267
Vulnrichment
Updated: 2025-05-21T19:35:54.051Z
NVD
Status : Analyzed
Published: 2025-05-21T17:15:57.570
Modified: 2025-07-22T16:41:59.423
Link: CVE-2025-20267
Redhat
No data.
OpenCVE Enrichment
No data.