VDB
CVE-2017-6788
CVE-2017-6788
PUBLISHED
CVSS 6.099999904632568 MEDIUM
The WebLaunch functionality of Cisco AnyConnect Secure Mobility Client Software contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the affected software. The vulnerability is due to insufficient input validation of some parameters that are passed to the WebLaunch function of the affected software. An attacker could exploit this vulnerability by convincing a user to access a malicious link or by intercepting a user request and injecting malicious code into the request. Cisco Bug IDs: CSCvf12055. Known Affected Releases: 98.89(40).
EPSS 0.23% · 46.1th percentile
Risk Scores
CVSS 3.0
6.099999904632568
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score
0.23%
46.1th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco Systems, Inc. | AnyConnect WebLaunch | 98.89(40) |
| cisco | anyconnect_secure_mobility_client | 4.5\(58\), * |
Exploit Intelligence
- 100364 (circl)
- 1039190 (circl)
- 20170816 Cisco AnyConnect WebLaunch Cross-Site Scripting Vulnerability (circl)
Timeline
- Aug 16, 2017 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Feb 28, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Nov 6, 2022 EPSS Score
- Jan 8, 2023 EPSS Score