CVE-2017-6700: XSS

Published Jul 4, 2017

Updated

A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an unauthenticated, remote attacker to conduct a Document Object Model (DOM) based (environment or client-side) cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. More Information: CSCvc24620 CSCvc49586. Known Affected Releases: 3.1(1) 2.0(4.0.45B).

Affected Software

2 affected components

cisco Prime Infrastructure=2.0\(4.0.45b\)

cisco Prime Infrastructure=3.1\(1\)

Event History

Jul 4, 2017

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-6700?

CVE-2017-6700 has been assigned a high severity rating due to the potential for remote, unauthenticated attackers to exploit the vulnerability.

How do I fix CVE-2017-6700?

To mitigate CVE-2017-6700, users should upgrade to the latest patched version of Cisco Prime Infrastructure or Evolved Programmable Network Manager.

What systems are affected by CVE-2017-6700?

CVE-2017-6700 affects Cisco Prime Infrastructure version 2.0(4.0.45b) and version 3.1(1).

What type of vulnerability is CVE-2017-6700?

CVE-2017-6700 is classified as a Document Object Model (DOM) based cross-site scripting (XSS) vulnerability.

Can CVE-2017-6700 be exploited by local users?

CVE-2017-6700 can be exploited by remote attackers without authentication, thus posing a significant risk.