Details of VAR-201708-1350

ID

VAR-201708-1350

CVE

CVE-2017-6761

TITLE

Cisco Finesse Vulnerable to cross-site scripting

Trust: 0.8

sources: JVNDB: JVNDB-2017-006840

DESCRIPTION

A vulnerability in the web-based management interface of Cisco Finesse 10.6(1) and 11.5(1) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvd96744. Cisco Finesse Contains a cross-site scripting vulnerability. Vendors have confirmed this vulnerability Bug ID CSCvd96744 It is released as.Information may be obtained and information may be altered. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. Cisco Finesse is a set of call center management software developed by Cisco. The software improves call center service quality, improves customer experience, and increases agent satisfaction

Trust: 1.98

sources: NVD: CVE-2017-6761 // JVNDB: JVNDB-2017-006840 // BID: 100110 // VULHUB: VHN-114964

AFFECTED PRODUCTS

vendor:	cisco	model:	finesse	scope:	eq	version:	10.6\(1\)	Trust: 1.6
vendor:	cisco	model:	finesse	scope:	eq	version:	11.5\(1\)	Trust: 1.6
vendor:	cisco	model:	finesse	scope:	eq	version:	11.5(1)	Trust: 1.1
vendor:	cisco	model:	finesse	scope:	eq	version:	10.6(1)	Trust: 1.1

sources: BID: 100110 // JVNDB: JVNDB-2017-006840 // CNNVD: CNNVD-201708-132 // NVD: CVE-2017-6761

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-6761
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2017-6761
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-201708-132
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-114964
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2017-6761
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-114964
severity:	MEDIUM
baseScore:	4.3
vectorString:	AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	8.6
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2017-6761
baseSeverity:	MEDIUM
baseScore:	6.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	CHANGED
confidentialityImpact:	LOW
integrityImpact:	LOW
availabilityImpact:	NONE
exploitabilityScore:	2.8
impactScore:	2.7
version:	3.0
Trust: 1.8

sources: VULHUB: VHN-114964 // JVNDB: JVNDB-2017-006840 // CNNVD: CNNVD-201708-132 // NVD: CVE-2017-6761

PROBLEMTYPE DATA

problemtype:

CWE-79

Trust: 1.9

sources: VULHUB: VHN-114964 // JVNDB: JVNDB-2017-006840 // NVD: CVE-2017-6761

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201708-132

TYPE

XSS

Trust: 0.6

sources: CNNVD: CNNVD-201708-132

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-006840

PATCH

title:	CSCvd96744 - Cisco Finesse Reflected Cross-Site Scripting Vulnerability	url:	https://quickview.cloudapps.cisco.com/quickview/bug/CSCvd96744	Trust: 0.8
title:	cisco-sa-20170802-cf	url:	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-cf	Trust: 0.8
title:	Cisco Finesse Fixes for cross-site scripting vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=72374	Trust: 0.6

sources: JVNDB: JVNDB-2017-006840 // CNNVD: CNNVD-201708-132

EXTERNAL IDS

db:	NVD	id:	CVE-2017-6761	Trust: 2.8
db:	BID	id:	100110	Trust: 2.0
db:	SECTRACK	id:	1039059	Trust: 1.7
db:	JVNDB	id:	JVNDB-2017-006840	Trust: 0.8
db:	CNNVD	id:	CNNVD-201708-132	Trust: 0.7
db:	VULHUB	id:	VHN-114964	Trust: 0.1

sources: VULHUB: VHN-114964 // BID: 100110 // JVNDB: JVNDB-2017-006840 // CNNVD: CNNVD-201708-132 // NVD: CVE-2017-6761

REFERENCES

url:	https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20170802-cf	Trust: 2.0
url:	http://www.securityfocus.com/bid/100110	Trust: 1.7
url:	https://quickview.cloudapps.cisco.com/quickview/bug/cscvd96744	Trust: 1.7
url:	http://www.securitytracker.com/id/1039059	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-6761	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-6761	Trust: 0.8
url:	http://www.cisco.com/	Trust: 0.3

sources: VULHUB: VHN-114964 // BID: 100110 // JVNDB: JVNDB-2017-006840 // CNNVD: CNNVD-201708-132 // NVD: CVE-2017-6761

CREDITS

Cisco

Trust: 0.9

sources: BID: 100110 // CNNVD: CNNVD-201708-132

SOURCES

db:	VULHUB	id:	VHN-114964
db:	BID	id:	100110
db:	JVNDB	id:	JVNDB-2017-006840
db:	CNNVD	id:	CNNVD-201708-132
db:	NVD	id:	CVE-2017-6761

LAST UPDATE DATE

2024-11-23T22:45:36.650000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-114964	date:	2019-10-09T00:00:00
db:	BID	id:	100110	date:	2017-08-03T00:00:00
db:	JVNDB	id:	JVNDB-2017-006840	date:	2017-09-05T00:00:00
db:	CNNVD	id:	CNNVD-201708-132	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2017-6761	date:	2024-11-21T03:30:27.993

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-114964	date:	2017-08-07T00:00:00
db:	BID	id:	100110	date:	2017-08-03T00:00:00
db:	JVNDB	id:	JVNDB-2017-006840	date:	2017-09-05T00:00:00
db:	CNNVD	id:	CNNVD-201708-132	date:	2017-08-04T00:00:00
db:	NVD	id:	CVE-2017-6761	date:	2017-08-07T06:29:00.573