CVE-2020-3157

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. The vulnerability is due to insufficient validation of user-supplied input to the web-based management interface. An attacker could exploit this vulnerability by crafting a malicious configuration and saving it to the targeted system. An exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information when an administrator views the configuration. An attacker would need write permissions to exploit this vulnerability successfully.

• CWE-79
• CWE-79

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-BR7nEDjGVendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-xss-BR7nEDjGVendor Advisory

Published

Mar 4, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-3151A vulnerability in the CLI of Cisco Connected Mobile Experie…6.7
• CVE-2020-3152A vulnerability in Cisco Connected Mobile Experiences (CMX) …6.7
• CVE-2020-3153A vulnerability in the installer component of Cisco AnyConne…6.5
• CVE-2020-3154A vulnerability in the web UI of Cisco Cloud Web Security (C…4.9
• CVE-2020-3155A vulnerability in the SSL implementation of the Cisco Intel…7.4
• CVE-2020-3156A vulnerability in the logging component of Cisco Identity S…6.1
• CVE-2020-3158A vulnerability in the High Availability (HA) service of Cis…9.1
• CVE-2020-3159A vulnerability in the web-based management interface of Cis…6.1
• CVE-2020-3160A vulnerability in the Extensible Messaging and Presence Pro…5.3
• CVE-2020-3161A vulnerability in the web server for Cisco IP Phones could …9.8
• CVE-2020-3162A vulnerability in the Constrained Application Protocol (CoA…7.5
• CVE-2020-3163A vulnerability in the Live Data server of Cisco Unified Con…5.9