{"api_version":"1","generated_at":"2026-07-23T09:19:09+00:00","cve":"CVE-2013-5523","urls":{"html":"https://cve.report/CVE-2013-5523","api":"https://cve.report/api/cve/CVE-2013-5523.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2013-5523","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2013-5523"},"summary":{"title":"CVE-2013-5523","description":"The Sponsor Portal in Cisco Identity Services Engine (ISE) 1.2 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a \"cross-frame scripting (XFS)\" issue, aka Bug ID CSCui82666.","state":"PUBLISHED","assigner":"cisco","published_at":"2013-10-10 10:55:06","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-20","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://osvdb.org/98168","name":"http://osvdb.org/98168","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.securityfocus.com/bid/62869","name":"http://www.securityfocus.com/bid/62869","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Cisco Identity Services Engine CVE-2013-5523 Cross Frame Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.securitytracker.com/id/1029157","name":"http://www.securitytracker.com/id/1029157","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Cisco Identity Services Engine Input Validation Flaw in Sponsor Portal Permits Cross-Frame Scripting Attacks - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/87724","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/87724","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/55207","name":"http://secunia.com/advisories/55207","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA55207 - Cisco Identity Services Engine (ISE) Sponsor Portal Clickjacking Vulnerability - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5523","name":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5523","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=31161","name":"http://tools.cisco.com/security/center/viewAlert.x?alertId=31161","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-5523","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-5523","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2013","cve_id":"5523","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_software","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"5523","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_software","cpe6":"1.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"5523","vulnerable":"1","versionEndIncluding":"1.2","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_software","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T17:15:20.807Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"1029157","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1029157"},{"name":"98168","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/98168"},{"name":"20131007 Cisco Identity Services Engine Sponsor Portal Cross-Frame Scripting Vulnerability","tags":["vendor-advisory","x_refsource_CISCO","x_transferred"],"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5523"},{"name":"cisco-ise-cve20135523-xfs(87724)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/87724"},{"name":"62869","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/62869"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=31161"},{"name":"55207","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/55207"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2013-10-07T00:00:00.000Z","descriptions":[{"lang":"en","value":"The Sponsor Portal in Cisco Identity Services Engine (ISE) 1.2 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a \"cross-frame scripting (XFS)\" issue, aka Bug ID CSCui82666."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","shortName":"cisco"},"references":[{"name":"1029157","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1029157"},{"name":"98168","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/98168"},{"name":"20131007 Cisco Identity Services Engine Sponsor Portal Cross-Frame Scripting Vulnerability","tags":["vendor-advisory","x_refsource_CISCO"],"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5523"},{"name":"cisco-ise-cve20135523-xfs(87724)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/87724"},{"name":"62869","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/62869"},{"tags":["x_refsource_CONFIRM"],"url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=31161"},{"name":"55207","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/55207"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@cisco.com","ID":"CVE-2013-5523","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Sponsor Portal in Cisco Identity Services Engine (ISE) 1.2 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a \"cross-frame scripting (XFS)\" issue, aka Bug ID CSCui82666."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"1029157","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1029157"},{"name":"98168","refsource":"OSVDB","url":"http://osvdb.org/98168"},{"name":"20131007 Cisco Identity Services Engine Sponsor Portal Cross-Frame Scripting Vulnerability","refsource":"CISCO","url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5523"},{"name":"cisco-ise-cve20135523-xfs(87724)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/87724"},{"name":"62869","refsource":"BID","url":"http://www.securityfocus.com/bid/62869"},{"name":"http://tools.cisco.com/security/center/viewAlert.x?alertId=31161","refsource":"CONFIRM","url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=31161"},{"name":"55207","refsource":"SECUNIA","url":"http://secunia.com/advisories/55207"}]}}}},"cveMetadata":{"assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","assignerShortName":"cisco","cveId":"CVE-2013-5523","datePublished":"2013-10-10T10:00:00.000Z","dateReserved":"2013-08-22T00:00:00.000Z","dateUpdated":"2024-08-06T17:15:20.807Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2013-10-10 10:55:06","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-20","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_software:*:*:*:*:*:*:*:*","versionEndIncluding":"1.2","matchCriteriaId":"63BC1BB0-33FB-4CBC-99AD-E9E6593B2A11"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_software:1.0:*:*:*:*:*:*:*","matchCriteriaId":"CA49BB84-9E6B-4510-B2DF-178C2E6C0CBE"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_software:1.1:*:*:*:*:*:*:*","matchCriteriaId":"50CE032F-3BD1-462D-B2DD-4088EA7CE037"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2013","CveId":"5523","Ordinal":"1","Title":"CVE-2013-5523","CVE":"CVE-2013-5523","Year":"2013"},"notes":[{"CveYear":"2013","CveId":"5523","Ordinal":"1","NoteData":"The Sponsor Portal in Cisco Identity Services Engine (ISE) 1.2 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a \"cross-frame scripting (XFS)\" issue, aka Bug ID CSCui82666.","Type":"Description","Title":"CVE-2013-5523"},{"CveYear":"2013","CveId":"5523","Ordinal":"2","NoteData":"2013-10-10","Type":"Other","Title":"Published"},{"CveYear":"2013","CveId":"5523","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}