Details of VAR-201901-0601

ID

VAR-201901-0601

CVE

CVE-2018-15440

TITLE

Cisco Identity Services Engine Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2018-013653

DESCRIPTION

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web interface of an affected system. The vulnerability is due to insufficient sanitization of user-supplied data that is written to log files and displayed in certain web pages of the web-based management interface of an affected device. An attacker could exploit this vulnerability by convincing a user of the interface to click a specific link or view an affected log file. The injected script code may be executed in the context of the web-based management interface or allow the attacker to access sensitive browser-based information. An attacker can exploit these vulnerabilities to execute arbitrary HTML script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or perform unauthorized actions. Other attacks are also possible. This issue being tracked by Cisco Bug ID's CSCvm71860 and CSCvm79609. The platform monitors the network by collecting real-time information on the network, users and devices, and formulating and implementing corresponding policies

Trust: 1.98

sources: NVD: CVE-2018-15440 // JVNDB: JVNDB-2018-013653 // BID: 106513 // VULHUB: VHN-125700

AFFECTED PRODUCTS

vendor:	cisco	model:	identity services engine software	scope:	eq	version:	2.4\(0.357\)	Trust: 1.0
vendor:	cisco	model:	identity services engine	scope:	-	version:	-	Trust: 0.8
vendor:	cisco	model:	identity services engine	scope:	eq	version:	2.4(0.357)	Trust: 0.3
vendor:	cisco	model:	identity services engine	scope:	eq	version:	0	Trust: 0.3

sources: BID: 106513 // JVNDB: JVNDB-2018-013653 // NVD: CVE-2018-15440

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-15440
value:	MEDIUM
Trust: 1.0
ykramarz@cisco.com:	CVE-2018-15440
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2018-15440
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201901-299
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-125700
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2018-15440
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-125700
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2018-15440
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	2.7
version:	3.0
Trust: 2.8

sources: VULHUB: VHN-125700 // JVNDB: JVNDB-2018-013653 // CNNVD: CNNVD-201901-299 // NVD: CVE-2018-15440 // NVD: CVE-2018-15440

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-125700 // JVNDB: JVNDB-2018-013653 // NVD: CVE-2018-15440

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201901-299

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201901-299

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-013653

PATCH

title:

cisco-sa-20190109-ise-multi-xss

url:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190109-ise-multi-xss

Trust: 0.8

sources: JVNDB: JVNDB-2018-013653

EXTERNAL IDS

db:	NVD	id:	CVE-2018-15440	Trust: 2.8
db:	BID	id:	106513	Trust: 2.0
db:	JVNDB	id:	JVNDB-2018-013653	Trust: 0.8
db:	CNNVD	id:	CNNVD-201901-299	Trust: 0.7
db:	VULHUB	id:	VHN-125700	Trust: 0.1

sources: VULHUB: VHN-125700 // BID: 106513 // JVNDB: JVNDB-2018-013653 // CNNVD: CNNVD-201901-299 // NVD: CVE-2018-15440

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190109-ise-multi-xss	Trust: 2.6
url:	http://www.securityfocus.com/bid/106513	Trust: 1.7
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-15440	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-15440	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3

sources: VULHUB: VHN-125700 // BID: 106513 // JVNDB: JVNDB-2018-013653 // CNNVD: CNNVD-201901-299 // NVD: CVE-2018-15440

CREDITS

The Cisco Product Security Incident Response Team (PSIRT) is aware of the existence of public exploit code targeting the vulnerabilities that are described in this advisory.

Trust: 0.6

sources: CNNVD: CNNVD-201901-299

SOURCES

db:	VULHUB	id:	VHN-125700
db:	BID	id:	106513
db:	JVNDB	id:	JVNDB-2018-013653
db:	CNNVD	id:	CNNVD-201901-299
db:	NVD	id:	CVE-2018-15440

LAST UPDATE DATE

2024-08-14T13:27:07.219000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-125700	date:	2019-10-09T00:00:00
db:	BID	id:	106513	date:	2019-01-09T00:00:00
db:	JVNDB	id:	JVNDB-2018-013653	date:	2019-02-27T00:00:00
db:	CNNVD	id:	CNNVD-201901-299	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2018-15440	date:	2019-10-09T23:35:37.953

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-125700	date:	2019-01-15T00:00:00
db:	BID	id:	106513	date:	2019-01-09T00:00:00
db:	JVNDB	id:	JVNDB-2018-013653	date:	2019-02-27T00:00:00
db:	CNNVD	id:	CNNVD-201901-299	date:	2019-01-10T00:00:00
db:	NVD	id:	CVE-2018-15440	date:	2019-01-15T19:29:00.343