# CVE-2017-3890: BlackBerry WatchDox Server reflected XSS in Appliance-X and vAPP

Source: https://junglewise.ai/threats/cve-2017-3890-blackberry-watchdox-server-reflected-xss-in-appliance-x-and-vapp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2017-01-13. Updated: 2026-05-13  
License: CC BY 4.0 with a link back

CVE-2017-3890 · Severity: medium · CVSS 6.1 · Published 2017-01-13

BlackBerry WatchDox (now Workspaces) is a secure file-sharing and collaboration platform. A vulnerability in its server components could allow an attacker to execute malicious scripts in a user's web browser if the user clicks a specially crafted link. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.

Vendors: [Blackberry](https://junglewise.ai/threats/vendors/blackberry).

## Quick answers

**Is CVE-2017-3890 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2017-3890 being exploited in the wild.

**How severe is CVE-2017-3890?** Medium severity, with a CVSS score of 6.1, published 13 January 2017.

**Which products and versions are affected?** Blackberry WatchDox Server Appliance-X 1.8.1 and earlier; Blackberry WatchDox Server vAPP 4.6.0 to 5.4.1; Blackberry Workspaces Vapp 4.6.0 to 5.4.1.

**Is there a fix for CVE-2017-3890?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2017-3890 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2017-3890?** Check whether you run Blackberry WatchDox Server Appliance-X, Blackberry WatchDox Server vAPP or Blackberry Workspaces Vapp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the BlackBerry WatchDox Server (Workspaces) Appliance-X (v1.8.1 and earlier) and vAPP (v4.6.0 through 5.4.1) components. The flaw is caused by improper neutralization of user-supplied input during web page generation. A remote, unauthenticated attacker can exploit this by persuading a user to follow a malicious link, resulting in the execution of arbitrary JavaScript in the context of the victim's browser session. This can be used to bypass same-origin policy protections, access cookies, or perform actions as the authenticated user.

## Affected products

- BlackBerry WatchDox Server Appliance-X 1.8.1 and earlier
- BlackBerry WatchDox Server vAPP 4.6.0 to 5.4.1
- BlackBerry Workspaces vAPP 4.6.0 to 5.4.1

## Timeline

- 2017-01-13: advisory: Initial NVD publication
- 2017-01-13: disclosed: BlackBerry security advisory published

## References

- [http://support.blackberry.com/kb/articleDetail?articleNumber=000038915](http://support.blackberry.com/kb/articleDetail?articleNumber=000038915)
- [http://www.securityfocus.com/bid/95442](http://www.securityfocus.com/bid/95442)