CVE-2022-20967
At a glance Severity MEDIUM 4.8 EPSS EPSS 0.54 % · percentile 45 (2026-10-27) State PUBLISHED Published 2023-01-18 Updated 2024-08-03 Assigner cisco NVD status Modified Description A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conduct cross-site scripting attacks against other users of the application web-based management interface.
This vulnerability is due to improper validation of input to an application feature before storage within the web-based management interface. An attacker could exploit this vulnerability by creating entries within the application interface that contain malicious HTML or script code. A successful exploit could allow the attacker to store malicious HTML or script code within the application interface for use in further cross-site scripting attacks.
Cisco has not yet released software updates that address this vulnerability.
Scores Version Score Vector Scored by CVSS 3.1 MEDIUM 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N cisco CVSS 3.1 MEDIUM 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N NVD · psirt@cisco.com (Secondary) CVSS 3.1 MEDIUM 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:cisco:identity_services_engine:*:*:*:*:*:*:*:* < 2.6.0cpe:2.3:a:cisco:identity_services_engine:2.6.0:-:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch1:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch10:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch11:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch12:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch2:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch3:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch5:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch6:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch7:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch8:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch9:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:2.7.0:-:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch1:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch2:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch3:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch4:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch5:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch6:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch7:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:3.0.0:-:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch1:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch2:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch3:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch4:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch5:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:3.0.0:patch6:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:3.1:-:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:3.1:patch1:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:3.1:patch3:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:3.1:patch4:*:*:*:*:*:*cpe:2.3:a:cisco:identity_services_engine:3.2:-:*:*:*:*:*:*Affected products
References
Sources
