PT-2017-17322 · Cisco · Cisco Unified Intelligence Center

Publicado 2017-09-07 · Atualizado 2019-10-09 · CVE-2017-6789

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Intelligence Center version 11.0(1)ES10

Description A vulnerability in the Cisco Unified Intelligence Center web interface could allow an unauthenticated, remote attacker to impact the integrity of the system by executing a Document Object Model (DOM)-based, environment or client-side cross-site scripting (XSS) attack. The issue occurs because user-supplied data in the DOM input is not validated. An attacker could exploit this by sending crafted URLs that contain malicious DOM statements to the affected system, potentially allowing the attacker to manipulate the database.

Recommendations For Cisco Unified Intelligence Center version 11.0(1)ES10, update the software to a version that includes the fix for the issue, as the current version is affected by the DOM-based XSS vulnerability.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2017-6789

Produtos afetados

Cisco Unified Intelligence Center

Referências · 6

• https://quickview.cloudapps.cisco.com/quickview/bug/CSCvf18325 · Aviso do Fabricante
• http://securitytracker.com/id/1039278 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-6789 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-cuic · Aviso do Fabricante
• http://securityfocus.com/bid/100646 · Nota
• https://osv.dev/vulnerability/CVE-2017-6789 · Aviso do Fabricante