Vulnerability Report

CVE-2017-3894

Title: Blackberry Unified Endpoint Manager Cross-Site Scripting (XSS)

XSS

Proof Of Concept

No public PoC currently indexed for CVE-2017-3894.

CWE Category CWE-79

Published Date May 10, 2017

Modified Date May 13, 2026

Exploit Status Not Found

Score 6.1 CVSS v3.0

Exploit Probability (EPSS)

0.36%

Vulnerability Summary

CVE-2017-3894: A stored cross site scripting vulnerability in the Management Console of BlackBerry Unified Endpoint Manager version 12.6.1 and earlier, and all versions of BES12, allows attackers to execute actions in the context of a Management Console administrator by uploading a malicious script and then persuading a target administrator to view the specific location of the malicious script within the Management Console.

Impacted Vendors

blackberry 2

Reference Links

http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber=000044565 http://www.securityfocus.com/bid/98552 http://www.securitytracker.com/id/1038465 http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber=000044565 http://www.securityfocus.com/bid/98552 http://www.securitytracker.com/id/1038465

CVSS v3.0

Source Entity [email protected]

Severity MEDIUM

6.1

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

REQUIRED

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

4.3

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:M/Au:N/C:N/I:P/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns