NVD Vulnerability Detail

CVE-2017-6789

Summary	A vulnerability in the Cisco Unified Intelligence Center web interface could allow an unauthenticated, remote attacker to impact the integrity of the system by executing a Document Object Model (DOM)-based, environment or client-side cross-site scripting (XSS) attack. The vulnerability occurs because user-supplied data in the DOM input is not validated. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious DOM statements to the affected system. A successful exploit could allow the attacker to affect the integrity of the system by manipulating the database. Known Affected Releases 11.0(1)ES10. Cisco Bug IDs: CSCvf18325.
Publication Date	Sept. 8, 2017, 6:29 a.m.
Registration Date	Jan. 26, 2021, 1:27 p.m.
Last Update	Nov. 21, 2024, 12:30 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:cisco:unified_intelligence_center:11.0\(1\)es10:::::::*

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/100646	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/100646	Third Party Advisory VDB Entry
3	http://www.securitytracker.com/id/1039278	Third Party Advisory VDB Entry
4	http://www.securitytracker.com/id/1039278	Third Party Advisory VDB Entry
5	https://quickview.cloudapps.cisco.com/quickview/bug/CSCvf18325	Vendor Advisory
6	https://quickview.cloudapps.cisco.com/quickview/bug/CSCvf18325	Vendor Advisory
7	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-cuic	Vendor Advisory
8	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-cuic	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

JVN Vulnerability Information

Cisco Unified Intelligence Center Web インターフェースにおけるクロスサイトスクリプティングの脆弱性

Title	Cisco Unified Intelligence Center Web インターフェースにおけるクロスサイトスクリプティングの脆弱性
Summary	Cisco Unified Intelligence Center Web インターフェースには、クロスサイトスクリプティングの脆弱性が存在します。ベンダは、本脆弱性を Bug ID CSCvf18325 として公開しています。
Possible impacts	情報を取得される、および情報を改ざんされる可能性があります。
Solution	ベンダ情報および参考情報を参照して適切な対策を実施してください。
Publication Date	Sept. 6, 2017, midnight
Registration Date	Oct. 3, 2017, 5:28 p.m.
Last Update	Oct. 3, 2017, 5:28 p.m.

Affected System

シスコシステムズ

Cisco Unified Intelligence Center 11.0(1)ES10

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-6789	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6789
National Vulnerability Database (NVD)
2	CVE-2017-6789	https://nvd.nist.gov/vuln/detail/CVE-2017-6789

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
Cisco Bug
1	CSCvf18325 - Open redirection (DOM-based)	https://quickview.cloudapps.cisco.com/quickview/bug/CSCvf18325
Cisco Security Advisory
2	cisco-sa-20170906-cuic	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-cuic

Change Log

No	Changed Details	Date of change
0	[2017年10月03日] 掲載	Feb. 17, 2018, 10:37 a.m.