Read the docs
TI-2020-03129 Aliases CVE-2020-3589GHSA-f9w4-crpr-pfpp

Cisco Identity Services Engine Cross-Site Scripting Vulnerability

Priority LOW 23CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker with administrative credentials to conduct a cross-site scripting (XSS) attack against a user of the interface. The vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information. To exploit this vulnerability, an attacker would need to have valid administrative credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00617 49th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Identity Services Engine Softwareall versions—No fix listedCNA
  • Cisco Identity Services Engine Software VendorCisco Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 52

CPEVersionsRoleVendor
cpe:2.3:a:cisco:identity_services_engine:2.2.0:patch16:*:*:*:*:*:*2.2.0 patch16VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch1:*:*:*:*:*:*2.2.0.470 patch1VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch10:*:*:*:*:*:*2.2.0.470 patch10VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch11:*:*:*:*:*:*2.2.0.470 patch11VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch12:*:*:*:*:*:*2.2.0.470 patch12VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch13:*:*:*:*:*:*2.2.0.470 patch13VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch14:*:*:*:*:*:*2.2.0.470 patch14VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch15:*:*:*:*:*:*2.2.0.470 patch15VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch16:*:*:*:*:*:*2.2.0.470 patch16VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch2:*:*:*:*:*:*2.2.0.470 patch2VulnerableCisco
  • cpe:2.3:a:cisco:identity_services_engine:2.2.0:patch16:*:*:*:*:*:* Versions 2.2.0 patch16 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch1:*:*:*:*:*:* Versions 2.2.0.470 patch1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch10:*:*:*:*:*:* Versions 2.2.0.470 patch10 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch11:*:*:*:*:*:* Versions 2.2.0.470 patch11 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch12:*:*:*:*:*:* Versions 2.2.0.470 patch12 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch13:*:*:*:*:*:* Versions 2.2.0.470 patch13 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch14:*:*:*:*:*:* Versions 2.2.0.470 patch14 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch15:*:*:*:*:*:* Versions 2.2.0.470 patch15 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch16:*:*:*:*:*:* Versions 2.2.0.470 patch16 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch2:*:*:*:*:*:* Versions 2.2.0.470 patch2 Vulnerable ·Cisco
Show 42 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch3:*:*:*:*:*:*2.2.0.470 patch3VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch4:*:*:*:*:*:*2.2.0.470 patch4VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch5:*:*:*:*:*:*2.2.0.470 patch5VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch6:*:*:*:*:*:*2.2.0.470 patch6VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch7:*:*:*:*:*:*2.2.0.470 patch7VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch8:*:*:*:*:*:*2.2.0.470 patch8VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch9:*:*:*:*:*:*2.2.0.470 patch9VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.3.0:patch7:*:*:*:*:*:*2.3.0 patch7VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.3.0.298:-:*:*:*:*:*:*2.3.0.298VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.3.0.298:patch1:*:*:*:*:*:*2.3.0.298 patch1VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.3.0.298:patch2:*:*:*:*:*:*2.3.0.298 patch2VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.3.0.298:patch3:*:*:*:*:*:*2.3.0.298 patch3VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.3.0.298:patch4:*:*:*:*:*:*2.3.0.298 patch4VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.3.0.298:patch5:*:*:*:*:*:*2.3.0.298 patch5VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.3.0.298:patch6:*:*:*:*:*:*2.3.0.298 patch6VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.3.0.298:patch7:*:*:*:*:*:*2.3.0.298 patch7VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.4.0:patch12:*:*:*:*:*:*2.4.0 patch12VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.4.0.357:-:*:*:*:*:*:*2.4.0.357VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.4.0.357:patch1:*:*:*:*:*:*2.4.0.357 patch1VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.4.0.357:patch10:*:*:*:*:*:*2.4.0.357 patch10VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.4.0.357:patch2:*:*:*:*:*:*2.4.0.357 patch2VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.4.0.357:patch3:*:*:*:*:*:*2.4.0.357 patch3VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.4.0.357:patch4:*:*:*:*:*:*2.4.0.357 patch4VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.4.0.357:patch5:*:*:*:*:*:*2.4.0.357 patch5VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.4.0.357:patch6:*:*:*:*:*:*2.4.0.357 patch6VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.4.0.357:patch7:*:*:*:*:*:*2.4.0.357 patch7VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.4.0.357:patch8:*:*:*:*:*:*2.4.0.357 patch8VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.4.0.357:patch9:*:*:*:*:*:*2.4.0.357 patch9VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.6.0:-:*:*:*:*:*:*2.6.0VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch1:*:*:*:*:*:*2.6.0 patch1VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch2:*:*:*:*:*:*2.6.0 patch2VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch3:*:*:*:*:*:*2.6.0 patch3VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch5:*:*:*:*:*:*2.6.0 patch5VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch6:*:*:*:*:*:*2.6.0 patch6VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch7:*:*:*:*:*:*2.6.0 patch7VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.6.0.156:patch1:*:*:*:*:*:*2.6.0.156 patch1VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.6.0.156:patch2:*:*:*:*:*:*2.6.0.156 patch2VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.6.0.156:patch3:*:*:*:*:*:*2.6.0.156 patch3VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.6.0.156:patch5:*:*:*:*:*:*2.6.0.156 patch5VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.6.0.156:patch6:*:*:*:*:*:*2.6.0.156 patch6VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.6.0.156:patch7:*:*:*:*:*:*2.6.0.156 patch7VulnerableCisco
cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch2:*:*:*:*:*:*2.7.0 patch2VulnerableCisco
  • cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch3:*:*:*:*:*:* Versions 2.2.0.470 patch3 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch4:*:*:*:*:*:* Versions 2.2.0.470 patch4 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch5:*:*:*:*:*:* Versions 2.2.0.470 patch5 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch6:*:*:*:*:*:* Versions 2.2.0.470 patch6 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch7:*:*:*:*:*:* Versions 2.2.0.470 patch7 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch8:*:*:*:*:*:* Versions 2.2.0.470 patch8 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.2.0.470:patch9:*:*:*:*:*:* Versions 2.2.0.470 patch9 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.3.0:patch7:*:*:*:*:*:* Versions 2.3.0 patch7 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.3.0.298:-:*:*:*:*:*:* Versions 2.3.0.298 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.3.0.298:patch1:*:*:*:*:*:* Versions 2.3.0.298 patch1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.3.0.298:patch2:*:*:*:*:*:* Versions 2.3.0.298 patch2 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.3.0.298:patch3:*:*:*:*:*:* Versions 2.3.0.298 patch3 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.3.0.298:patch4:*:*:*:*:*:* Versions 2.3.0.298 patch4 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.3.0.298:patch5:*:*:*:*:*:* Versions 2.3.0.298 patch5 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.3.0.298:patch6:*:*:*:*:*:* Versions 2.3.0.298 patch6 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.3.0.298:patch7:*:*:*:*:*:* Versions 2.3.0.298 patch7 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.4.0:patch12:*:*:*:*:*:* Versions 2.4.0 patch12 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.4.0.357:-:*:*:*:*:*:* Versions 2.4.0.357 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.4.0.357:patch1:*:*:*:*:*:* Versions 2.4.0.357 patch1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.4.0.357:patch10:*:*:*:*:*:* Versions 2.4.0.357 patch10 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.4.0.357:patch2:*:*:*:*:*:* Versions 2.4.0.357 patch2 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.4.0.357:patch3:*:*:*:*:*:* Versions 2.4.0.357 patch3 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.4.0.357:patch4:*:*:*:*:*:* Versions 2.4.0.357 patch4 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.4.0.357:patch5:*:*:*:*:*:* Versions 2.4.0.357 patch5 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.4.0.357:patch6:*:*:*:*:*:* Versions 2.4.0.357 patch6 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.4.0.357:patch7:*:*:*:*:*:* Versions 2.4.0.357 patch7 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.4.0.357:patch8:*:*:*:*:*:* Versions 2.4.0.357 patch8 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.4.0.357:patch9:*:*:*:*:*:* Versions 2.4.0.357 patch9 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.6.0:-:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch1:*:*:*:*:*:* Versions 2.6.0 patch1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch2:*:*:*:*:*:* Versions 2.6.0 patch2 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch3:*:*:*:*:*:* Versions 2.6.0 patch3 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch5:*:*:*:*:*:* Versions 2.6.0 patch5 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch6:*:*:*:*:*:* Versions 2.6.0 patch6 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.6.0:patch7:*:*:*:*:*:* Versions 2.6.0 patch7 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.6.0.156:patch1:*:*:*:*:*:* Versions 2.6.0.156 patch1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.6.0.156:patch2:*:*:*:*:*:* Versions 2.6.0.156 patch2 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.6.0.156:patch3:*:*:*:*:*:* Versions 2.6.0.156 patch3 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.6.0.156:patch5:*:*:*:*:*:* Versions 2.6.0.156 patch5 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.6.0.156:patch6:*:*:*:*:*:* Versions 2.6.0.156 patch6 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.6.0.156:patch7:*:*:*:*:*:* Versions 2.6.0.156 patch7 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:identity_services_engine:2.7.0:patch2:*:*:*:*:*:* Versions 2.7.0 patch2 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-3589
  2. 2026-10-03 Alias added: GHSA-f9w4-crpr-pfpp

References

Advisory 1

  • TI-2026-53488 Cisco Identity Services Engine Authentication Bypass Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-14632 Cisco ISE API Unauthenticated Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-14578 Cisco ISE API Unauthenticated Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 10.0
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-14579 Cisco ISE API Unauthenticated Remote Code Execution Vulnerability CVSS 3.1CRITICAL 10.0
  • TI-2022-05522 OS command injection in Cisco Identity Services Engine Software CVSS 3.1HIGH 8.8
See all 197 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences