Vulnslist

Cisco product, release, and evidence lookup

Cisco Prime Infrastructure Cross-Site Scripting Vulnerability

cisco-sa-20170301-cpi · Medium · Published · Updated

Data: Cisco advisories · Cisco CSAF · NVD CVEs · NVD CPEs · CISA KEV · EPSS

A vulnerability in the HTTP web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web interface of the affected system. The vulnerability is due to insufficient input validation of a user-supplied value. An attacker could exploit this vulnerability by convincing a user to click a specific link. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170301-cpi

Cisco advisory ·CSAF JSON

Workarounds

There are no workarounds that address this vulnerability. For additional information about cross-site scripting attacks and the methods used to exploit these vulnerabilities, see the Cisco Applied Mitigation Bulletin Understanding Cross-Site Scripting (XSS) Threat Vectors https://tools.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20060922-understanding-xss .

CVEsCVE-2017-3848
Cisco Bug IDsCSCuw63001 , CSCuw63003
CVSS ScoreBase 5.3
Base 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:X/RL:X/RC:X

Products with public affected evidence

Product CVE Affected evidence
Cisco Prime Infrastructure CVE-2017-3848 structured affected CSAF product_status