CVE-2017-6661

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA) and Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device, aka Message Tracking XSS. More Information: CSCvd30805 CSCvd34861. Known Affected Releases: 10.0.0-203 10.1.0-049.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	Cisco Email Security and Content Security Management Appliance	Cisco Email Security and Content Security Management Appliance

References

http://www.securityfocus.com/bid/98950Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038637
http://www.securitytracker.com/id/1038638
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-esaVendor Advisory
http://www.securityfocus.com/bid/98950Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038637
http://www.securitytracker.com/id/1038638
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-esaVendor Advisory

Timeline

Published: Jun 13, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-66628.0A vulnerability in the web-based user interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could all CVE-2017-66636.5A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent CVE-2017-66647.5A vulnerability in the Autonomic Networking feature of Cisco IOS XE Software could allow an unauthenticated, remote, autonomic node to acces CVE-2017-66656.5A vulnerability in the Autonomic Networking feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent CVE-2017-66666.0A vulnerability in the forwarding component of Cisco IOS XR Software for Cisco Network Convergence System (NCS) 5500 Series Routers could al CVE-2017-66679.8A vulnerability in the update process for the dynamic JAR file of the Cisco Context Service software development kit (SDK) could allow an un CVE-2017-66684.9Vulnerabilities in the web-based GUI of Cisco Unified Communications Domain Manager (CUCDM) could allow an authenticated, remote attacker to CVE-2017-66697.8Multiple buffer overflow vulnerabilities exist in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files. An att CVE-2017-66706.1A vulnerability in the web-based GUI of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to redir CVE-2017-66717.5A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthentica CVE-2017-66727.5A vulnerability in certain filtering mechanisms of access control lists (ACLs) for Cisco ASR 5000 Series Aggregation Services Routers throug CVE-2017-66736.5A vulnerability in Cisco Firepower Management Center could allow an authenticated, remote attacker to obtain user information. An attacker c