CVE-2019-15281: Cisco Identity Services Engine Stored Cross-Site Scripting Vulnerability

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-16 · updated 2026-06-17
Weakness: CWE-79

Description

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The attacker must have valid administrator credentials. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected software. An attacker could exploit this vulnerability by injecting malicious code into a troubleshooting file. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Affected products

Cisco Identity Services Engine unknown: before 2.4\(0.357\); 2.4(0.357), 2.4(0.357)-patch1, 2.4(0.357)-patch2, 2.4(0.357)-patch3, 2.4(0.357)-patch4, 2.4(0.357)-patch5 (+4) — fixed in 2.4\(0.357\)

How to fix

Upgrade to a fixed version: Cisco Identity Services Engine unknown 2.4\(0.357\). Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-15281 or the next vulnerability affects your stack