Lucene search

[email protected]CVE-2017-3894

HistoryMay 10, 2017 - 4:29 p.m.

CVE-2017-3894

2017-05-1016:29:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2017-3894

cross site scripting

xss

blackberry

uem

bes12

vulnerability

nvd

security

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.4%

JSON

A stored cross site scripting vulnerability in the Management Console of BlackBerry Unified Endpoint Manager version 12.6.1 and earlier, and all versions of BES12, allows attackers to execute actions in the context of a Management Console administrator by uploading a malicious script and then persuading a target administrator to view the specific location of the malicious script within the Management Console.

Affected configurations

NVD

Node

blackberryenterprise_serviceMatch12.0

blackberryenterprise_serviceMatch12.0.1

blackberryenterprise_serviceMatch12.1

blackberryenterprise_serviceMatch12.1.0

blackberryenterprise_serviceMatch12.1.1

blackberryenterprise_serviceMatch12.2.0

blackberryenterprise_serviceMatch12.2.1

blackberryenterprise_serviceMatch12.3.0

blackberryenterprise_serviceMatch12.3.1

blackberryenterprise_serviceMatch12.4.0

blackberryenterprise_serviceMatch12.4.1

blackberryenterprise_serviceMatch12.5.0

blackberryenterprise_serviceMatch12.5.1

blackberryenterprise_serviceMatch12.5.2

blackberryunified_endpoint_managerRange≤12.6.1

CPENameOperatorVersion
blackberry:enterprise_serviceblackberry enterprise serviceeq12.0
blackberry:enterprise_serviceblackberry enterprise serviceeq12.0.1
blackberry:enterprise_serviceblackberry enterprise serviceeq12.1
blackberry:enterprise_serviceblackberry enterprise serviceeq12.1.0
blackberry:enterprise_serviceblackberry enterprise serviceeq12.1.1
blackberry:enterprise_serviceblackberry enterprise serviceeq12.2.0
blackberry:enterprise_serviceblackberry enterprise serviceeq12.2.1
blackberry:enterprise_serviceblackberry enterprise serviceeq12.3.0
blackberry:enterprise_serviceblackberry enterprise serviceeq12.3.1
blackberry:enterprise_serviceblackberry enterprise serviceeq12.4.0

CPE	Name	Operator	Version
blackberry:enterprise_service	blackberry enterprise service	eq	12.0
blackberry:enterprise_service	blackberry enterprise service	eq	12.0.1
blackberry:enterprise_service	blackberry enterprise service	eq	12.1
blackberry:enterprise_service	blackberry enterprise service	eq	12.1.0
blackberry:enterprise_service	blackberry enterprise service	eq	12.1.1
blackberry:enterprise_service	blackberry enterprise service	eq	12.2.0
blackberry:enterprise_service	blackberry enterprise service	eq	12.2.1
blackberry:enterprise_service	blackberry enterprise service	eq	12.3.0
blackberry:enterprise_service	blackberry enterprise service	eq	12.3.1
blackberry:enterprise_service	blackberry enterprise service	eq	12.4.0

Rows per page:

1-10 of 151

CNA Affected

[
  {
    "product": "Unified Endpoint Manager",
    "vendor": "BlackBerry",
    "versions": [
      {
        "status": "affected",
        "version": "before 12.6.2"
      }
    ]
  },
  {
    "product": "BES12",
    "vendor": "BlackBerry",
    "versions": [
      {
        "status": "affected",
        "version": "all versions"
      }
    ]
  }
]

References

support.blackberry.com/kb/articleDetail?language=en_US&articleNumber=000044565

www.securityfocus.com/bid/98552

www.securitytracker.com/id/1038465

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

48.4%

JSON

Related for CVE-2017-3894

prion1 cvelist1 nvd1