CVE-2017-6749 — Cross-site Scripting in Cisco WEB Security Appliance

CWE-79 — Cross-site Scripting CWE-94 — Code Injection5 documents5 sources

Severity

5.4MEDIUMNVD

GHSA7.4

EPSS

0.2%

top 53.49%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco WEB Security Appliance Cisco WEB Security Appliance Cisco WEB Security Virtual Appliance

Timeline

PublishedJul 25

Latest updateMay 17

Description

A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. Affected Products: virtual and hardware versions of Cisco Web Security Appliance (WSA). More Information: CSCvd88865. Known Affected Releases: 10.1.0-204.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NExploitability: 2.3 | Impact: 2.7

Affected Packages3 packages

▶NVDcisco/web_security_virtual_appliance7 versions+6

▶NVDcisco/web_security_appliance11 versions+10

▶CVEListV5cisco/cisco_web_security_applianceCisco Web Security Appliance

🔴Vulnerability Details

GHSA

GHSA-532j-mh9h-gc6c: A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to conduct a↗2022-05-17

▶

GHSA

Code Injection in oauth2-server↗2021-04-22

▶

CVEList

CVE-2017-6749: A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to conduct a↗2017-07-25

▶

📋Vendor Advisories

Cisco

Cisco Web Security Appliance Stored Cross-Site Scripting Vulnerability↗2017-07-19

▶