CVE-2013-5523

The Sponsor Portal in Cisco Identity Services Engine (ISE) 1.2 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCui82666.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
ciscoCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 66%
VendorProductVersion
ciscoidentity_services_engine_software
𝑥
≤ 1.2
ciscoidentity_services_engine_software
1.0
ciscoidentity_services_engine_software
1.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://osvdb.org/98168
http://secunia.com/advisories/55207
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5523
http://tools.cisco.com/security/center/viewAlert.x?alertId=31161
http://www.securityfocus.com/bid/62869
http://www.securitytracker.com/id/1029157
https://exchange.xforce.ibmcloud.com/vulnerabilities/87724
http://osvdb.org/98168
http://secunia.com/advisories/55207
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5523
http://tools.cisco.com/security/center/viewAlert.x?alertId=31161
http://www.securityfocus.com/bid/62869
http://www.securitytracker.com/id/1029157
https://exchange.xforce.ibmcloud.com/vulnerabilities/87724