1. Home
  2. CVE Database
  3. CVE-2017-3894
MEDIUM · 6.1

CVE-2017-3894

A stored cross site scripting vulnerability in the Management Console of BlackBerry Unified Endpoint Manager version 12.6.1 and earlier, and all versions of BES12, allows attackers to execute actions ...

Vulnerability Description

A stored cross site scripting vulnerability in the Management Console of BlackBerry Unified Endpoint Manager version 12.6.1 and earlier, and all versions of BES12, allows attackers to execute actions in the context of a Management Console administrator by uploading a malicious script and then persuading a target administrator to view the specific location of the malicious script within the Management Console.

CVSS Score

6.1

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
BlackberryEnterprise Service12.0
BlackberryUnified Endpoint Manager<= 12.6.1

Related Weaknesses (CWE)

CWE-79

References

FAQ

What is CVE-2017-3894?

CVE-2017-3894 is a vulnerability with a CVSS score of 6.1 (MEDIUM). A stored cross site scripting vulnerability in the Management Console of BlackBerry Unified Endpoint Manager version 12.6.1 and earlier, and all versions of BES12, allows attackers to execute actions ...

How severe is CVE-2017-3894?

CVE-2017-3894 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-3894?

Check the references section above for vendor advisories and patch information. Affected products include: Blackberry Enterprise Service, Blackberry Unified Endpoint Manager.