CVE-2017-3894
Severity Score
6.1
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
A stored cross site scripting vulnerability in the Management Console of BlackBerry Unified Endpoint Manager version 12.6.1 and earlier, and all versions of BES12, allows attackers to execute actions in the context of a Management Console administrator by uploading a malicious script and then persuading a target administrator to view the specific location of the malicious script within the Management Console.
Una vulnerabilidad de tipo cross-site scripting almacenado en la Consola de Administración de BlackBerry Unified Endpoint Manager versión 12.6.1 y anteriores, y todas las versiones de BES12, permite a los atacantes ejecutar acciones en el contexto de un administrador de la Consola de Administración mediante la carga de un script malicioso y luego persuadiendo a un administrador destino para visualizar la ubicación específica del script malicioso dentro de la Consola de Administración.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2016-12-21 CVE Reserved
- 2017-05-10 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/98552 | Vdb Entry | |
| http://www.securitytracker.com/id/1038465 | Vdb Entry |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber=000044565 | 2017-07-08 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Blackberry Search vendor "Blackberry" | Enterprise Service Search vendor "Blackberry" for product "Enterprise Service" | 12.0 Search vendor "Blackberry" for product "Enterprise Service" and version "12.0" | - |
Affected
| ||||||
| Blackberry Search vendor "Blackberry" | Enterprise Service Search vendor "Blackberry" for product "Enterprise Service" | 12.0.1 Search vendor "Blackberry" for product "Enterprise Service" and version "12.0.1" | - |
Affected
| ||||||
| Blackberry Search vendor "Blackberry" | Enterprise Service Search vendor "Blackberry" for product "Enterprise Service" | 12.1 Search vendor "Blackberry" for product "Enterprise Service" and version "12.1" | - |
Affected
| ||||||
| Blackberry Search vendor "Blackberry" | Enterprise Service Search vendor "Blackberry" for product "Enterprise Service" | 12.1.0 Search vendor "Blackberry" for product "Enterprise Service" and version "12.1.0" | - |
Affected
| ||||||
| Blackberry Search vendor "Blackberry" | Enterprise Service Search vendor "Blackberry" for product "Enterprise Service" | 12.1.1 Search vendor "Blackberry" for product "Enterprise Service" and version "12.1.1" | - |
Affected
| ||||||
| Blackberry Search vendor "Blackberry" | Enterprise Service Search vendor "Blackberry" for product "Enterprise Service" | 12.2.0 Search vendor "Blackberry" for product "Enterprise Service" and version "12.2.0" | - |
Affected
| ||||||
| Blackberry Search vendor "Blackberry" | Enterprise Service Search vendor "Blackberry" for product "Enterprise Service" | 12.2.1 Search vendor "Blackberry" for product "Enterprise Service" and version "12.2.1" | - |
Affected
| ||||||
| Blackberry Search vendor "Blackberry" | Enterprise Service Search vendor "Blackberry" for product "Enterprise Service" | 12.3.0 Search vendor "Blackberry" for product "Enterprise Service" and version "12.3.0" | - |
Affected
| ||||||
| Blackberry Search vendor "Blackberry" | Enterprise Service Search vendor "Blackberry" for product "Enterprise Service" | 12.3.1 Search vendor "Blackberry" for product "Enterprise Service" and version "12.3.1" | - |
Affected
| ||||||
| Blackberry Search vendor "Blackberry" | Enterprise Service Search vendor "Blackberry" for product "Enterprise Service" | 12.4.0 Search vendor "Blackberry" for product "Enterprise Service" and version "12.4.0" | - |
Affected
| ||||||
| Blackberry Search vendor "Blackberry" | Enterprise Service Search vendor "Blackberry" for product "Enterprise Service" | 12.4.1 Search vendor "Blackberry" for product "Enterprise Service" and version "12.4.1" | - |
Affected
| ||||||
| Blackberry Search vendor "Blackberry" | Enterprise Service Search vendor "Blackberry" for product "Enterprise Service" | 12.5.0 Search vendor "Blackberry" for product "Enterprise Service" and version "12.5.0" | - |
Affected
| ||||||
| Blackberry Search vendor "Blackberry" | Enterprise Service Search vendor "Blackberry" for product "Enterprise Service" | 12.5.1 Search vendor "Blackberry" for product "Enterprise Service" and version "12.5.1" | - |
Affected
| ||||||
| Blackberry Search vendor "Blackberry" | Enterprise Service Search vendor "Blackberry" for product "Enterprise Service" | 12.5.2 Search vendor "Blackberry" for product "Enterprise Service" and version "12.5.2" | - |
Affected
| ||||||
| Blackberry Search vendor "Blackberry" | Unified Endpoint Manager Search vendor "Blackberry" for product "Unified Endpoint Manager" | <= 12.6.1 Search vendor "Blackberry" for product "Unified Endpoint Manager" and version " <= 12.6.1" | - |
Affected
| ||||||