XSS in Blackberry Bes12
CVE-2017-3894
A stored cross site scripting vulnerability in the Management Console of BlackBerry Unified Endpoint Manager version 12.6.1 and earlier, and all versions of BES12, allows attackers to execute actions in the context of a Management Console…
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.008 (54.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Blackberry Bes12 — versions all versions
- Blackberry Enterprise_service — versions 12.0, 12.0.1, 12.1
- Blackberry Unified Endpoint Manager — versions before 12.6.2
- Blackberry Unified_endpoint_manager
Weakness classification (CWE)
References
- secure@blackberry.com (vdb-entry, x_refsource_BID)
- secure@blackberry.com (x_refsource_CONFIRM, Vendor Advisory)
- secure@blackberry.com (vdb-entry, x_refsource_SECTRACK)
Frequently asked questions
- What is CVE-2017-3894?
- CVE-2017-3894 is a medium-severity vulnerability in Blackberry Bes12, classified under Cross-site Scripting. CVSS score: 6.1/10. Published 2017-05-10.
- How severe is CVE-2017-3894?
- Medium severity. CVSS v3 base score is 6.1 out of 10.