CVE-2024-20539: Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability

What it is

A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct a stored XSS attack against a user of the interface.

This vulnerability exists because the web-based management interface does not sufficiently validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker would need valid administrative credentials on an affected device.

Exploitation

The Cisco PSIRT is not aware of any public announcements or malicious use of the vulnerabilities that are described in this advisory.