CVE-2017-6749

Summary

CVE	CVE-2017-6749
State	PUBLISHED
Assigner	cisco
Source Priority	CVE Program / NVD first with legacy fallback
Published	2017-07-25 19:29:00 UTC
Updated	2025-04-20 01:37:25 UTC
Description	A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. Affected Products: virtual and hardware versions of Cisco Web Security Appliance (WSA). More Information: CSCvd88865. Known Affected Releases: 10.1.0-204.

Primary CVSS: v3.0 5.4 MEDIUM from [email protected]

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Problem Types: CWE-79 | Stored Cross-Site Scripting Vulnerability

Version	Source	Type	Score	Severity	Vector
3.0	[email protected]	Primary	5.4	MEDIUM	`CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N`
2.0	[email protected]	Primary	3.5		`AV:N/AC:M/Au:S/C:N/I:P/A:N`

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Access Vector

Network

Access Complexity

Medium

Authentication

Single

Confidentiality

None

Integrity

Partial

Availability

None

AV:N/AC:M/Au:S/C:N/I:P/A:N

Type	Vendor	Product	Version	Update	Edition	Language
Application	Cisco	Web Security Appliance	10.0.0-232	All	All	All
Application	Cisco	Web Security Appliance	10.0.0-233	All	All	All
Application	Cisco	Web Security Appliance	10.0_base	All	All	All
Application	Cisco	Web Security Appliance	10.1.0	All	All	All
Application	Cisco	Web Security Appliance	10.1.0-204	All	All	All
Application	Cisco	Web Security Appliance	10.1.1-230	All	All	All
Application	Cisco	Web Security Appliance	10.1.1-234	All	All	All
Application	Cisco	Web Security Appliance	10.1.1-235	All	All	All
Application	Cisco	Web Security Appliance	10.5.0	All	All	All
Application	Cisco	Web Security Appliance	10.5.0-358	All	All	All
Application	Cisco	Web Security Appliance	10.5.1-270	All	All	All
Application	Cisco	Web Security Virtual Appliance	10.0.0	All	All	All
Application	Cisco	Web Security Virtual Appliance	10.0_base	All	All	All
Application	Cisco	Web Security Virtual Appliance	10.1.0	All	All	All
Application	Cisco	Web Security Virtual Appliance	10.1.1	All	All	All
Application	Cisco	Web Security Virtual Appliance	10.1_base	All	All	All
Application	Cisco	Web Security Virtual Appliance	10.5.1	All	All	All
Application	Cisco	Web Security Virtual Appliance	10.5_base	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Na	Cisco Web Security Appliance	affected Cisco Web Security Appliance	Not specified

Reference	Source	Link	Tags
Cisco Web Security Appliance Stored Cross-Site Scripting Vulnerability	af854a3a-2127-422b-91ae-364da2661108	tools.cisco.com	Vendor Advisory
Cisco Web Security Appliance Input Validation Flaw Lets Remote Users Conduct Cross-Site Scripting Attacks - SecurityTracker	af854a3a-2127-422b-91ae-364da2661108	www.securitytracker.com	Third Party Advisory, VDB Entry
Cisco Web Security Appliance CVE-2017-6749 HTML Injection Vulnerability	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com	Third Party Advisory, VDB Entry
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.