CVE-2015-4266

Cisco Identity Services Engine Software 1.1(4.1) 1.3(106.146) 1.3(120.135) - Cross-Frame Scripting via IFRAME Element

Title source: llm
STIX 2.1

Description

The web interface in Cisco Identity Services Engine (ISE) 1.1(4.1), 1.3(106.146), and 1.3(120.135) does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCut04556.

References (2)

Core 2
Core References
Vendor Advisory vendor-advisory x_refsource_cisco
http://tools.cisco.com/security/center/viewAlert.x?alertId=39871
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1032930

Scores

EPSS 0.0116
EPSS Percentile 63.5%

Details

CWE
CWE-20
Status published
Products (3)
cisco/identity_services_engine_software 1.1\(4.1\)
cisco/identity_services_engine_software 1.3\(106.146\)
cisco/identity_services_engine_software 1.3\(120.135\)
Published Jul 16, 2015
Tracked Since Feb 18, 2026