CVE-2013-5523

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

The Sponsor Portal in Cisco Identity Services Engine (ISE) 1.2 and earlier does not properly restrict use of IFRAME elements, which makes it easier for remote attackers to conduct clickjacking attacks and unspecified other attacks via a crafted web site, related to a "cross-frame scripting (XFS)" issue, aka Bug ID CSCui82666.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://osvdb.org/98168
http://secunia.com/advisories/55207
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5523Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=31161Vendor Advisory
http://www.securityfocus.com/bid/62869Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029157Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/87724
http://osvdb.org/98168
http://secunia.com/advisories/55207
http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5523Vendor Advisory
http://tools.cisco.com/security/center/viewAlert.x?alertId=31161Vendor Advisory
http://www.securityfocus.com/bid/62869Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1029157Third Party Advisory, VDB Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/87724

Timeline

Published: Oct 10, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-55244.3Cross-site scripting (XSS) vulnerability in the troubleshooting page in Cisco Identity Services Engine (ISE) 1.2 and earlier allows remote a CVE-2013-55256.5SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2 and earlier allows remote authenticated users t CVE-2013-55267.1Cisco 9900 fourth-generation IP phones do not properly perform SDP negotiation, which allows remote attackers to cause a denial of service (CVE-2013-55275.7The OSPF functionality in Cisco IOS and IOS XE allows remote attackers to cause a denial of service (device reload) via crafted options in a CVE-2013-55284.0Directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authentic CVE-2013-55296.8The deployment module in the server in Cisco WebEx Meeting Center does not properly validate the passphrase, which allows remote attackers t CVE-2013-55309.0The web framework in Cisco Identity Services Engine (ISE) 1.0 and 1.1.0 before 1.1.0.665-5, 1.1.1 before 1.1.1.268-7, 1.1.2 before 1.1.2.145 CVE-2013-55315.0Cisco Identity Services Engine (ISE) 1.x before 1.1.1 allows remote attackers to bypass authentication, and read support-bundle configuratio CVE-2013-55325.0Buffer overflow in the web-application interface on Cisco 9900 IP phones allows remote attackers to cause a denial of service (webapp interf CVE-2013-55336.0The image-upgrade functionality on Cisco 9900 Unified IP phones allows local users to gain privileges by placing shell commands in an unspec CVE-2013-55344.0Directory traversal vulnerability in the attachment service in the Voice Message Web Service (aka VMWS or Cisco Unity Web Service) in Cisco CVE-2013-55356.4The analytics page on Cisco Video Surveillance 4000 IP cameras has hardcoded credentials, which allows remote attackers to watch the video f