VulnerabilityModified
CVE-2014-0680
Cross-site scripting (XSS) vulnerability in the HTTP control interface in the NAC Web Agent component in Cisco Identity Services Engine (ISE) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCui15038.
MEDIUM 4.3EPSS 1.95%
Does this matter?
Lower severity and a low EPSS score (1.95%). Track it; it rarely justifies an emergency change on its own.
Description
Cross-site scripting (XSS) vulnerability in the HTTP control interface in the NAC Web Agent component in Cisco Identity Services Engine (ISE) allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka Bug ID CSCui15038.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 1.95% probability · 79th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79
- Affected
- cisco/identity services engine
- Source
- psirt@cisco.com
References
- http://osvdb.org/102588
- http://secunia.com/advisories/56672
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0680Vendor Advisory
- http://tools.cisco.com/security/center/viewAlert.x?alertId=32617
- http://www.securityfocus.com/bid/65227
- http://www.securitytracker.com/id/1029701
- http://osvdb.org/102588
- http://secunia.com/advisories/56672
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-0680Vendor Advisory
- http://tools.cisco.com/security/center/viewAlert.x?alertId=32617
- http://www.securityfocus.com/bid/65227
- http://www.securitytracker.com/id/1029701
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.