XSS in Blackberry Bes12
CVE-2017-3894
A stored cross site scripting vulnerability in the Management Console of BlackBerry Unified Endpoint Manager version 12.6.1 and earlier, and all versions of BES12, allows attackers to execute actions in the context of a Management Console administrator by uploading a malicious script and then persuading a target administrator to view the specific location of the malicious script within the Management Console.
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.008 (56.4th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 56th percentile — 56.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000
Affected products
- Blackberry Bes12 — versions all versions
- Blackberry Enterprise Service — versions 12.0, 12.0.1, 12.1
- Blackberry Unified Endpoint Manager — versions before 12.6.2
- Blackberry Unified Endpoint Manager
Weakness classification (CWE)
References
- www.securityfocus.com/bid/98552 (vdb-entry)
- support.blackberry.com/kb/articleDetail (Vendor Advisory)
- www.securitytracker.com/id/1038465 (vdb-entry)
Frequently asked questions
- What is CVE-2017-3894?
- CVE-2017-3894 is a medium-severity vulnerability in Blackberry Bes12, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2017-05-10.
- How severe is CVE-2017-3894?
- Medium severity. CVSS v3 base score is 6.1 out of 10.