CVE-2017-6699: XSS

Published Jul 4, 2017

Updated

A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. More Information: CSCvc24616 CSCvc35363 CSCvc49574. Known Affected Releases: 3.1(1) 2.0(4.0.45B).

Affected Software

6 affected components

cisco Evolved Programmable Network Manager=2.0\(4.0.45b\)

cisco Evolved Programmable Network Manager=2.0\(4.0.45d\)

cisco Evolved Programmable Network Manager=2.0.0

cisco Prime Infrastructure=3.1

cisco Prime Infrastructure=3.1\(0.128\)

cisco Prime Infrastructure=3.1.1

Event History

Jul 4, 2017

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-6699?

CVE-2017-6699 has a moderate severity rating due to its potential for reflected cross-site scripting attacks.

How do I fix CVE-2017-6699?

To mitigate CVE-2017-6699, apply the latest patches provided by Cisco for the affected versions of Cisco Prime Infrastructure and Evolved Programmable Network Manager.

Which products are affected by CVE-2017-6699?

CVE-2017-6699 affects Cisco Prime Infrastructure versions 3.1 and 3.1.1, and Cisco Evolved Programmable Network Manager versions 2.0(4.0.45b), 2.0(4.0.45d), and 2.0.0.

Can CVE-2017-6699 be exploited remotely?

Yes, CVE-2017-6699 can be exploited by unauthenticated remote attackers through the web-based management interface.

What type of attack does CVE-2017-6699 facilitate?

CVE-2017-6699 facilitates reflected cross-site scripting (XSS) attacks against users of the vulnerable web interface.