Is CVE-2017-3890 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-3890 being exploited in the wild.

How severe is CVE-2017-3890?

Medium severity, with a CVSS score of 6.1, published 13 January 2017.

Which products and versions are affected?

Blackberry WatchDox Server Appliance-X 1.8.1 and earlier; Blackberry WatchDox Server vAPP 4.6.0 to 5.4.1; Blackberry Workspaces Vapp 4.6.0 to 5.4.1.

Is there a fix for CVE-2017-3890?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2017-3890 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2017-3890?

Check whether you run Blackberry WatchDox Server Appliance-X, Blackberry WatchDox Server vAPP or Blackberry Workspaces Vapp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-3890: BlackBerry WatchDox Server reflected XSS in Appliance-X and vAPP

CVE-2017-3890 · Severity: medium · CVSS 6.1 · Published 2017-01-13

BlackBerry WatchDox (now Workspaces) is a secure file-sharing and collaboration platform. A vulnerability in its server components could allow an attacker to execute malicious scripts in a user's web browser if the user clicks a specially crafted link. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.

Vendors: Blackberry.

Quick answers

Is CVE-2017-3890 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-3890 being exploited in the wild.
How severe is CVE-2017-3890?: Medium severity, with a CVSS score of 6.1, published 13 January 2017.
Which products and versions are affected?: Blackberry WatchDox Server Appliance-X 1.8.1 and earlier; Blackberry WatchDox Server vAPP 4.6.0 to 5.4.1; Blackberry Workspaces Vapp 4.6.0 to 5.4.1.
Is there a fix for CVE-2017-3890?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2017-3890 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2017-3890?: Check whether you run Blackberry WatchDox Server Appliance-X, Blackberry WatchDox Server vAPP or Blackberry Workspaces Vapp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the BlackBerry WatchDox Server (Workspaces) Appliance-X (v1.8.1 and earlier) and vAPP (v4.6.0 through 5.4.1) components. The flaw is caused by improper neutralization of user-supplied input during web page generation. A remote, unauthenticated attacker can exploit this by persuading a user to follow a malicious link, resulting in the execution of arbitrary JavaScript in the context of the victim's browser session. This can be used to bypass same-origin policy protections, access cookies, or perform actions as the authenticated user.

Affected products

BlackBerry WatchDox Server Appliance-X 1.8.1 and earlier
BlackBerry WatchDox Server vAPP 4.6.0 to 5.4.1
BlackBerry Workspaces vAPP 4.6.0 to 5.4.1

Timeline

2017-01-13: advisory: Initial NVD publication
2017-01-13: disclosed: BlackBerry security advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.