CVE-2024-20479

CVSS 3.1 Score 4.8 of 10 (medium)

Details

Published Aug 7, 2024
Updated: Aug 23, 2024
CWE ID 79

Summary

CVE-2024-20479 is a newly disclosed vulnerability affecting the web-based management interface of Cisco ISE. This issue permits authenticated, remote attackers to execute Cross-Site Scripting (XSS) attacks against users of the interface. The vulnerability stems from insufficient input validation by the interface, allowing attackers to inject malicious code into specific pages. A successful exploit could lead to the execution of arbitrary script code in the context of the affected interface or the access of sensitive browser-based information. It is crucial to note that an attacker must possess Admin privileges on the targeted device to exploit this vulnerability.

Ligh bulbPrevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.

Share

Affected Products

  • Cisco Identity Services Engine

Affected Vendors

  • Cisco Systems Inc