CVE-2017-17442 Cross-site scripting in UEM Management Console

Medium 6.1 Published 13 Mar 2018 Updated 17 Sep 2024

Reflected XSS in BlackBerry UEM Management Console allows attackers to execute scripts and potentially take over accounts via malicious links.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2017-17442?

CVE-2017-17442 is a medium-severity cross-site scripting vulnerability in BlackBerry UEM Management Console, published on 13 Mar 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In BlackBerry UEM Management Console version 12.7.1 and earlier, a reflected cross-site scripting vulnerability that could allow an attacker to execute script commands in the context of the affected UEM Management Console account by crafting a malicious link and then persuading a user with legitimate access to the Management Console to click on the malicious link.

Weakness: CWE-79

Which versions are affected by CVE-2017-17442?

It affects 1 product.

Products include Blackberry Unified Endpoint Manager.

How do I fix CVE-2017-17442?

No fix has been published for CVE-2017-17442 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2017-17442 being exploited?

There is no known exploitation of CVE-2017-17442 in the wild and no public exploit code.

Sources

Also known as GHSA-mcr9-9rqf-6w42.