CVE-2017-6788

EPSS 1.2%

Vexday Risk Score

3Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS —EPSS 1.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

17 ago 2017Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

The WebLaunch functionality of Cisco AnyConnect Secure Mobility Client Software contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the affected software. The vulnerability is due to insufficient input validation of some parameters that are passed to the WebLaunch function of the affected software. An attacker could exploit this vulnerability by convincing a user to access a malicious link or by intercepting a user request and injecting malicious code into the request. Cisco Bug IDs: CSCvf12055. Known Affected Releases: 98.89(40).

Produtos afetados

Cisco Systems, Inc. · AnyConnect WebLaunch

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170816-caw http://www.securityfocus.com/bid/100364 http://www.securitytracker.com/id/1039190