CVE-2017-12269

medium Cisco
CVSS v3 Base Score
5.4
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
EPSS Score
0.4%
Exploitation probability in 30 days
Top 42% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Published: October 5, 2017 (3143 days ago)
Last Modified: May 13, 2026
Vendor: Cisco
Source: NVD

Description

A vulnerability in the web UI of Cisco Spark Messaging Software could allow an authenticated, remote attacker to perform a stored cross-site scripting (XSS) attack. The vulnerability is due to insufficient input validation by the web UI of the affected software. An attacker could exploit this vulnerability by injecting XSS content into the web UI of the affected software. A successful exploit could allow the attacker to force a user to execute code of the attacker's choosing or allow the attacker to retrieve sensitive information from the user. Cisco Bug IDs: CSCvf70587, CSCvf70592.

CWE

CWE-79

Affected Products

cisco spark

References

🔗 www.securityfocus.com 🔗 tools.cisco.com 🔗 www.securityfocus.com 🔗 tools.cisco.com