Is CVE-2017-3802 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-3802 being exploited in the wild.

How severe is CVE-2017-3802?

Medium severity, with a CVSS score of 6.1, published 26 January 2017.

Which products and versions are affected?

Cisco Unified Communications Manager (CUCM) 12.0(0.99000.9).

Is there a fix for CVE-2017-3802?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2017-3802 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2017-3802?

Check whether you run Cisco Unified Communications Manager. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-3802: Cisco Unified Communications Manager XSS in web interface

CVE-2017-3802 · Severity: medium · CVSS 6.1 · Published 2017-01-26

Cisco Unified Communications Manager, a system used for managing enterprise voice and video calls, contains a security flaw in its web management interface. An attacker could trick a legitimate user into clicking a malicious link, allowing the attacker to execute unauthorized scripts in the user's browser. This could lead to the theft of session information or unauthorized actions being performed on the management console.

Technologies: Cisco Unified Communications Manager. Vendors: Cisco.

Quick answers

Is CVE-2017-3802 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-3802 being exploited in the wild.
How severe is CVE-2017-3802?: Medium severity, with a CVSS score of 6.1, published 26 January 2017.
Which products and versions are affected?: Cisco Unified Communications Manager (CUCM) 12.0(0.99000.9).
Is there a fix for CVE-2017-3802?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2017-3802 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2017-3802?: Check whether you run Cisco Unified Communications Manager. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the web interface of Cisco Unified Communications Manager (CUCM). The flaw is caused by the application's failure to properly invoke XSS filter subsystems when processing specific URL parameters. An unauthenticated remote attacker can exploit this by persuading a user to follow a specially crafted link or visit a malicious website. Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the affected site, potentially leading to session hijacking or unauthorized administrative actions. The vulnerability is tracked as Cisco Bug ID CSCvc20679 and has been addressed in multiple fixed releases of version 12.0.

Affected products

Cisco Unified Communications Manager (CUCM) 12.0(0.99000.9)

Timeline

2017-01-18: disclosed: Initial public release by Cisco
2017-01-19: advisory: Updated technical information published by Cisco
2017-01-26: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.