CVE-2017-12347

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into DCNM configuration parameters, redirect a user to a malicious website, inject malicious content into a DCNM client interface, or conduct a cross-site scripting (XSS) attack against a user of the affected software. Cisco Bug IDs: CSCvf40477, CSCvf63150, CSCvf68218, CSCvf68235, CSCvf68247.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	Cisco Data Center Network Manager Software	Cisco Data Center Network Manager Software

References

http://www.securityfocus.com/bid/101996Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-dcnmVendor Advisory
http://www.securityfocus.com/bid/101996Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-dcnmVendor Advisory

Timeline

Published: Nov 30, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-123485.4Multiple vulnerabilities in the web-based management interface of Cisco UCS Central Software could allow a remote attacker to conduct a cros CVE-2017-123495.4Multiple vulnerabilities in the web-based management interface of Cisco UCS Central Software could allow a remote attacker to conduct a cros CVE-2017-12356.5IBM WebSphere MQ 8.0 could allow an authenticated user to cause a premature termination of a client application thread which could potential CVE-2017-123508.2A vulnerability in Cisco Umbrella Insights Virtual Appliances 2.1.0 and earlier could allow an authenticated, local attacker to log in to an CVE-2017-123515.7A vulnerability in the guest shell feature of Cisco NX-OS System Software could allow an authenticated, local attacker to read and send pack CVE-2017-123526.7A vulnerability in certain system script files that are installed at boot time on Cisco Application Policy Infrastructure Controllers could CVE-2017-123535.8A vulnerability in the Multipurpose Internet Mail Extensions (MIME) scanner of Cisco AsyncOS Software for Cisco Email Security Appliances (E CVE-2017-123545.3A vulnerability in the web-based interface of Cisco Secure Access Control System (ACS) could allow an unauthenticated, remote attacker to vi CVE-2017-123555.3A vulnerability in the Local Packet Transport Services (LPTS) ingress frame-processing functionality of Cisco IOS XR Software could allow an CVE-2017-123566.1A vulnerability in the web-based management interface of Cisco Jabber for Windows, Mac, Android, and iOS could allow an unauthenticated, rem CVE-2017-123575.4A vulnerability in the web-based management interface of Cisco Unified Communications Manager could allow an authenticated, remote attacker CVE-2017-123585.4A vulnerability in the web-based management interface of Cisco Jabber for Windows, Mac, Android, and iOS could allow an authenticated, remot