CVE-2017-12254: XSS
First published: Thu Sep 21 2017(Updated: )
A vulnerability in the web interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker to perform a Document Object Model (DOM)-based cross-site scripting attack. The vulnerability is due to insufficient input validation of some parameters passed to the web server. An attacker could exploit this vulnerability by convincing the user to access a malicious link or by intercepting the user request and injecting the malicious code. An exploit could allow the attacker to execute arbitrary code in the context of the affected site or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCve76848, CSCve76856.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unified Intelligence Center | =11.5\(1\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2017-12254?
CVE-2017-12254 is classified as a high severity vulnerability due to its potential for exploitation via remote attacks.
How do I fix CVE-2017-12254?
To resolve CVE-2017-12254, it is recommended to apply the latest security patches provided by Cisco for the affected version of Unified Intelligence Center.
Who is affected by CVE-2017-12254?
CVE-2017-12254 affects users of Cisco Unified Intelligence Center version 11.5(1) and potentially other versions if the vulnerability is present.
What type of attack does CVE-2017-12254 enable?
CVE-2017-12254 enables an unauthenticated, remote attacker to perform a Document Object Model (DOM)-based cross-site scripting attack.
Is authentication required to exploit CVE-2017-12254?
No, authentication is not required to exploit CVE-2017-12254, making it a critical vulnerability.
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/description
- agent/type
- agent/event
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco unified intelligence center
- version/cisco unified intelligence center/11.5\(1\)