© 2026 vulntracker.io

CVE-2024-20251

MEDIUM

5.4

CVSS Score

Published: January 17, 2024 at 04:55 PM UTC

Updated: June 17, 2026 at 07:06 AM UTC

1 product affected across 1 vendorIdentity Services Engine

Using Cisco Identity Services Engine Software by Cisco?

Get instant alerts when new vulnerabilities affect Cisco Identity Services Engine Software - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.4

Exploit prediction

EPSS 0.4%

SSVC

No known exploit

Description

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack against a user of the interface on an affected device. This vulnerability exists because the web-based management interface does not properly validate user-supplied input. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Identity Services Engine · Cisco

95%

1.0 1.0.4 1.1 1.1.1 1.1.2 1.1.3 1.1.4 1.2 1.2(1.199)1.2.1 1.3 1.3(0.722)1.3(0.876)1.3(0.909)1.3(106.146)1.3(120.135)1.4 1.4(0.109)1.4(0.181)1.4(0.253)1.4(0.908)2.0 2.0(0.147)2.0(0.169)2.0(0.222)2.0(0.234)2.0(0.249)2.0(0.306)2.0(1.130)2.0.1 2.004(0.914)2.006(0.156)2.007(0.356)2.1 2.1(0.474)2.1(0.476)2.1(0.800)2.1(0.904)2.1(0.907)2.1(102.101)2.1(102.103)2.2 2.2(0.283)2.2(0.470)2.2(0.471)2.2(0.903)2.2(0.909)2.2(0.910)2.2(1.145)2.2.0 2.2.0 patch1 2.2.0 patch10 2.2.0 patch12 2.2.0 patch13 2.2.0 patch14 2.2.0 patch15 2.2.0 patch16 2.2.0 patch17 2.2.0 patch2 2.2.0 patch3 2.2.0 patch4 2.2.0 patch5 2.2.0 patch6 2.2.0 patch7 2.2.0 patch8 2.2.0 patch92.2.0.4702.2.0.470 patch1 2.2.0.470 patch10 2.2.0.470 patch11 2.2.0.470 patch12 2.2.0.470 patch13 2.2.0.470 patch14 2.2.0.470 patch15 2.2.0.470 patch16 2.2.0.470 patch2 2.2.0.470 patch3 2.2.0.470 patch4 2.2.0.470 patch5 2.2.0.470 patch6 2.2.0.470 patch7 2.2.0.470 patch8 2.2.0.470 patch9 2.3 2.3(0.151)2.3(0.298)2.3(0.904)2.3(0.905)2.3.0 2.3.0 patch1 2.3.0 patch2 2.3.0 patch3 2.3.0 patch4 2.3.0 patch5 2.3.0 patch6 2.3.0 patch72.3.0.2982.3.0.298 patch1 2.3.0.298 patch2 2.3.0.298 patch3 2.3.0.298 patch4 2.3.0.298 patch5 2.3.0.298 patch6 2.3.0.298 patch7 2.4 2.4(0.192)2.4(0.247)2.4(0.357)2.4(0.901)2.4(0.901.1)2.4(0.902)2.4(0.903)2.4(0.904)2.4(100.159)2.4.0 2.4.0 patch1 2.4.0 patch10 2.4.0 patch11 2.4.0 patch12 2.4.0 patch13 2.4.0 patch14 2.4.0 patch2 2.4.0 patch3 2.4.0 patch4 2.4.0 patch5 2.4.0 patch6 2.4.0 patch7 2.4.0 patch8 2.4.0 patch9 2.4.0 patch_112.4.0.3572.4.0.357 patch1 2.4.0.357 patch10 2.4.0.357 patch11 2.4.0.357 patch12 2.4.0.357 patch2 2.4.0.357 patch3 2.4.0.357 patch4 2.4.0.357 patch5 2.4.0.357 patch6 2.4.0.357 patch7 2.4.0.357 patch8 2.4.0.357 patch9 2.5 2.5(0.1)2.5(0.225)2.5(0.353)2.6 2.6(0.156)2.6(0.999)2.6.0 2.6.0 patch1 2.6.0 patch10 2.6.0 patch11 2.6.0 patch12 2.6.0 patch2 2.6.0 patch3 2.6.0 patch4 2.6.0 patch5 2.6.0 patch6 2.6.0 patch7 2.6.0 patch8 2.6.0 patch9 2.6.0.156 patch1 2.6.0.156 patch2 2.6.0.156 patch3 2.6.0.156 patch5 2.6.0.156 patch6 2.6.0.156 patch7 2.7 2.7(0.207)2.7(0.356)2.7(0.903)2.7.0 2.7.0 p1 2.7.0 p10 2.7.0 p2 2.7.0 p3 2.7.0 p4 2.7.0 p5 2.7.0 p6 2.7.0 p7 2.7.0 p8 2.7.0 p9 2.7.0 patch1 2.7.0 patch2 2.7.0 patch3 2.7.0 patch4 2.7.0 patch5 2.7.0 patch6 2.7.0 patch7 2.7.0 patch8 2.7.0 patch9 2.7.0.356 patch1 3.0(0.458)3.0.0 3.0.0 p1 3.0.0 p2 3.0.0 p3 3.0.0 p4 3.0.0 p5 3.0.0 p6 3.0.0 p7 3.0.0 p8 3.0.0 patch1 3.0.0 patch2 3.0.0 patch3 3.0.0 patch4 3.0.0 patch5 3.0.0 patch6 3.0.0 patch7 3.000(0.458)3.1 3.1 patch1 3.1 patch2 3.1 patch3 3.1 patch4 3.1 patch5 3.1 patch6 3.1 patch7 3.1.0 3.1.0 p1 3.1.0 p2 3.1.0 p3 3.1.0 p4 3.1.0 p5 3.1.0 p6 3.1.0 p7 3.2 3.2 patch1 3.2 patch2 3.2 patch3 3.2 patch4 3.2.0 3.2.0 p1 3.2.0 p2 3.2.0 p3 3.2.0 p4 3.3.0

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-XSS-bL4VTML

References (1)

Vendor Advisory

Source: [email protected]

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ISE-XSS-bL4VTML

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

5.4MEDIUM[email protected]

Attack Vector: NETWORK
Complexity: LOW
Privileges: LOW
User Interaction: REQUIRED
Scope: CHANGED
Confidentiality: LOW
Integrity: LOW
Availability: NONE

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-79

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card