BID:109297

Cisco Identity Services Engine CVE-2019-1941 Cross Site Scripting Vulnerability

CVE-2019-1941 |

Info

Cisco Identity Services Engine CVE-2019-1941 Cross Site Scripting Vulnerability

Bugtraq ID:	109297
Class:	Input Validation Error
CVE:	CVE-2019-1941
Remote:	Yes
Local:	No
Published:	Jul 17 2019 12:00AM
Updated:	Jul 17 2019 12:00AM
Credit:	Cisco
Vulnerable:	Cisco Identity Services Engine 2.3 + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco Identity Services Engine 2.2.1 Patch 1 Cisco Identity Services Engine 2.2 Patch 10 Cisco Identity Services Engine 1.2 899-2 Cisco Identity Services Engine 1.2 899 Cisco Identity Services Engine 1.1.4 218 Cisco Identity Services Engine 1.1.3 + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco Identity Services Engine 1.0.4 573-6 Cisco Identity Services Engine 1.0.4 + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco Identity Services Engine 2.4(0.902) Cisco Identity Services Engine 2.4(0.901.1) Cisco Identity Services Engine 2.4(0.901) Cisco Identity Services Engine 2.4(0.357) Cisco Identity Services Engine 2.4(0.183) Cisco Identity Services Engine 2.4 Patch 2 Cisco Identity Services Engine 2.4 Cisco Identity Services Engine 2.3(0.905) Cisco Identity Services Engine 2.3(0.904) Cisco Identity Services Engine 2.3(0.298) Cisco Identity Services Engine 2.3 Patch 5 Cisco Identity Services Engine 2.2.0.470-Patch5 Cisco Identity Services Engine 2.2.0 patch 2 Cisco Identity Services Engine 2.2.0 Cisco Identity Services Engine 2.2(0.913) Cisco Identity Services Engine 2.2(0.911) Cisco Identity Services Engine 2.2(0.910) Cisco Identity Services Engine 2.2(0.470) Cisco Identity Services Engine 2.2(0.231) Cisco Identity Services Engine 2.1.0 Patch7 Cisco Identity Services Engine 2.1.0 Cisco Identity Services Engine 2.1(0.908) Cisco Identity Services Engine 2.1(0.907) Cisco Identity Services Engine 2.1(0.188) Cisco Identity Services Engine 2.1 patch 5 Cisco Identity Services Engine 2.0.1 Cisco Identity Services Engine 2.0(0.901) Cisco Identity Services Engine 2.0 Cisco Identity Services Engine 1.4(0.908) Cisco Identity Services Engine 1.4 patch 7 Cisco Identity Services Engine 1.4 patch 6 Cisco Identity Services Engine 1.4 patch 5 Cisco Identity Services Engine 1.4 patch 4 Cisco Identity Services Engine 1.4 patch 3 Cisco Identity Services Engine 1.4 patch 2 Cisco Identity Services Engine 1.4 patch 1 Cisco Identity Services Engine 1.4 Cisco Identity Services Engine 1.3(0.876) Cisco Identity Services Engine 1.3 patch 6 Cisco Identity Services Engine 1.3 patch 5 Cisco Identity Services Engine 1.3 patch 4 Cisco Identity Services Engine 1.3 patch 3 Cisco Identity Services Engine 1.3 patch 2 Cisco Identity Services Engine 1.3 patch 1 Cisco Identity Services Engine 1.3 Cisco Identity Services Engine 1.2(0.967) + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco Identity Services Engine 1.2 patch 9 Cisco Identity Services Engine 1.2 patch 8 Cisco Identity Services Engine 1.2 patch 7 Cisco Identity Services Engine 1.2 patch 6 Cisco Identity Services Engine 1.2 patch 5 Cisco Identity Services Engine 1.2 patch 4 Cisco Identity Services Engine 1.2 patch 3 Cisco Identity Services Engine 1.2 patch 2 Cisco Identity Services Engine 1.2 patch 1 Cisco Identity Services Engine 1.2 + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco Identity Services Engine 1.1 patch 6 Cisco Identity Services Engine 1.1 patch 5 Cisco Identity Services Engine 1.1 patch 4 Cisco Identity Services Engine 1.1 patch 3 Cisco Identity Services Engine 1.1 Patch 2 Cisco Identity Services Engine 1.1 patch 1 Cisco Identity Services Engine 1.1 + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco Identity Services Engine 1.0.4.MR2 + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server Cisco Identity Services Engine 1.0.4.573 Cisco Identity Services Engine 1.0 MR Cisco Identity Services Engine 1.0 + Cisco Unity Server 4.0 + Cisco Unity Server 3.3 + Cisco Unity Server 3.2 + Cisco Unity Server 3.1 + Cisco Unity Server 3.0 + Cisco Unity Server 2.46 + Cisco Unity Server 2.4 + Cisco Unity Server 2.3 + Cisco Unity Server 2.2 + Cisco Unity Server 2.1 + Cisco Unity Server 2.0 + Cisco Unity Server

Not Vulnerable:	Cisco Identity Services Engine 2.6 Cisco Identity Services Engine 2.4 Patch 9

Exploit / POC

Cisco Identity Services Engine CVE-2019-1941 Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.