Multiple stored and reflected cross-site scripting vulnerabilities exist in Cisco Identity Services Engine's web management interface due to improper neutralization of input during web page generation. Authenticated remote attackers with administrative write privileges can inject malicious scripts that execute in the context of the interface, potentially exposing sensitive browser-based information. The vulnerability affects a broad range of versions from 3.1.0 to 3.4 Patch 1. The CVSS 3.1 base score is 4.8 (medium severity), reflecting network attack vector, low attack complexity, high privileges required, user interaction required, and partial confidentiality and integrity impact. No vendor-provided patch or remediation level is currently documented.

Successful exploitation allows an authenticated attacker with administrative write privileges to perform stored or reflected XSS attacks against users of the Cisco ISE web interface. This can lead to execution of arbitrary script code in the context of the management interface, potentially exposing sensitive browser-based information. The vulnerability does not impact availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Cisco vendor advisory for current remediation guidance. Until an official fix is available, limit administrative write access to trusted users only and exercise caution when clicking links or viewing pages in the Cisco ISE management interface. Monitor Cisco advisories for updates on patches or mitigations.