CVE-2024-20479: Cisco Identity Services Engine Software: vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface
This Cisco advisory covers CVE-2024-20479 in Identity Services Engine Software.
- CVE-2024-20479
Key facts
- Vendor rating
- Medium, CVSS 4.8
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N· base score 4.8, scored by ciscoAttack vector: network. Attack complexity: low. Privileges required: high. User interaction: required. Scope: changed. Confidentiality impact: low. Integrity impact: low. Availability impact: none.- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CISA SSVC
- Exploitation: none observed. Automatable: no. Technical impact: total. CISA, .
- CISA KEV
- Not listed (catalogue checked )
- Affected
- Scope: At the time of publication, these vulnerabilities affected Cisco ISE, regardless of device configuration.; 2.7 — Migrate to a fixed release; 3.0 — Migrate to a fixed release and 3 more below
- Fixed in
- 3.1P9, 3.2P7 (Sep 2024), 3.3P3
- Source published
- Source revised
- Listed by VulniPulse
Compiled by VulniPulse from the linked sources. How records are collected and checked.
Affected products & platforms
Description
Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct cross-site scripting (XSS) attacks against a user of the interface. For more information about these vulnerabilities, see the Details section of this advisory.
Affected product named by the advisory: Identity Services Engine Software.
Text from the source record.
- Scope: At the time of publication, these vulnerabilities affected Cisco ISE, regardless of device configuration.
- 2.7 — Migrate to a fixed release
- 3.0 — Migrate to a fixed release
- Release 3.1 (first fixed: 3.1P9)
- Release 3.2 (first fixed: 3.2P7 (Sep 2024))
- Release 3.3 (first fixed: 3.3P3)
Official advisory · high-confidence parse· fetched ·verify at source
How to fix CVE-2024-20479
Upgrade to a fixed release named by Cisco:
- 3.1P9
- 3.2P7 (Sep 2024)
- 3.3P3
Vendor guidance
- Upgrade to the first fixed release for your train per the Fixed Releases table in this advisory.
- Release 2.7: migrate to a fixed release.
- Release 3.0: migrate to a fixed release.
- Release 3.1: upgrade to 3.1P9.
- Release 3.2: upgrade to 3.2P7 (Sep 2024).
- Release 3.3: upgrade to 3.3P3.
Workaround status
- There are no workarounds that address these vulnerabilities.
End-of-life dates for Cisco ISE
More Cisco advisories
CVE-2026-20241Nov 4, 2026Cisco Identity Services Engine Authorization Bypass VulnerabilityCVE-2026-20247Sep 16, 2026Cisco Identity Services Engine SQL Injection VulnerabilitiesCVE-2026-20352Sep 16, 2026Cisco Identity Services Engine RADIUS Denial of Service VulnerabilityCVE-2026-76460Sep 16, 2026Cisco Identity Services Engine Authentication Bypass VulnerabilityCVE-2026-20305Sep 16, 2026Cisco Identity Services Engine Command Injection VulnerabilitiesCVE-2026-20130Sep 16, 2026Cisco Identity Services Engine Hardening Release: September 2026
Get an email when Cisco ISE publishes the next one.
See Cisco ISE's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor future Cisco CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
