PT-2017-17322 · Cisco · Cisco Unified Intelligence Center

Published 2017-09-07 · Updated 2019-10-09 · CVE-2017-6789

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Unified Intelligence Center version 11.0(1)ES10

Description A vulnerability in the Cisco Unified Intelligence Center web interface could allow an unauthenticated, remote attacker to impact the integrity of the system by executing a Document Object Model (DOM)-based, environment or client-side cross-site scripting (XSS) attack. The issue occurs because user-supplied data in the DOM input is not validated. An attacker could exploit this by sending crafted URLs that contain malicious DOM statements to the affected system, potentially allowing the attacker to manipulate the database.

Recommendations For Cisco Unified Intelligence Center version 11.0(1)ES10, update the software to a version that includes the fix for the issue, as the current version is affected by the DOM-based XSS vulnerability.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-6789

Affected Products

Cisco Unified Intelligence Center

References · 6

• https://quickview.cloudapps.cisco.com/quickview/bug/CSCvf18325 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6789 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-cuic · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6789 · Vendor Advisory
• http://securitytracker.com/id/1039278 · Note
• http://securityfocus.com/bid/100646 · Note