← Vulnerability feed

Vulnerability record · CVE-2018-0413 · published 1 August 2018

CVE-2018-0413: Cisco identity services engine software cross-site request forgery vulnerability

Cisco · Identity Services Engine Software

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. Cisco Bug IDs: CSCvi85159.

8.8 CVSS 3.0 High EPSS 1.2% · top 32.2% CWE-352 · Cross-site request forgery
8.8CVSS 3.0 base score, v2 6.8
1.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on a targeted device via a web browser and with the privileges of the user. Cisco Bug IDs: CSCvi85159.

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/104950 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041408 Third Party AdvisoryVDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180801-ise-csrf Vendor Advisory
http://www.securityfocus.com/bid/104950 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1041408 Third Party AdvisoryVDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180801-ise-csrf Vendor Advisory

Track CVE-2018-0413 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2011-3290Cisco identity services engine vulnerabilityCisco Identity Services Engine (ISE) before 1.0.4.MR2 has default Oracle database credentials, which allows remote attackers to modify settings or pe…EPSS 2.3%9.8CVE-2015-6323Cisco identity services engine software vulnerabilityThe Admin portal in Cisco Identity Services Engine (ISE) 1.1.x, 1.2.0 before patch 17, 1.2.1 before patch 8, 1.3 before patch 5, and 1.4 before patch…EPSS 3.0%9.0CVE-2013-5530Cisco identity services engine software os command injection vulnerabilityThe web framework in Cisco Identity Services Engine (ISE) 1.0 and 1.1.0 before 1.1.0.665-5, 1.1.1 before 1.1.1.268-7, 1.1.2 before 1.1.2.145-10, 1.1.…EPSS 2.3%8.8CVE-2017-3835Cisco identity services engine software sql injection vulnerabilityA vulnerability in the sponsor portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to access notices owned b…EPSS 1.8%7.5CVE-2017-12316Cisco identity services engine software improper authentication vulnerabilityA vulnerability in the Guest Portal login page of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to perform mul…EPSS 2.0%7.5CVE-2016-1402Cisco identity services engine software memory buffer overflow vulnerabilityThe Active Directory (AD) integration component in Cisco Identity Service Engine (ISE) before 1.2.0.899 patch 7, when AD group-membership authorizati…EPSS 2.0%6.8CVE-2015-4267Cisco identity services engine software cross-site request forgery vulnerabilityCross-site request forgery (CSRF) vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(0.793), 1.3(0.876), 1.4(0.109), 2.0(…EPSS 1.00%6.8CVE-2013-5540Cisco identity services engine software vulnerabilityThe file-upload feature in Cisco Identity Services Engine (ISE) allows remote authenticated users to cause a denial of service (disk consumption and …EPSS 1.1%

Source: NIST National Vulnerability Database (record CVE-2018-0413), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.