Vulnerability record · CVE-2017-3866 · published 17 March 2017

CVE-2017-3866: Cisco prime service catalog cross-site scripting vulnerability

Cisco · Prime Service Catalog

A vulnerability in the web framework code of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of the affected system. More Information: CSCvc79842 CSCvc79846 CSCvc79855 CSCvc79873 CSCvc79882 CSCvc79891. Known Affected Releases: 11.1.2.

6.1 CVSS 3.0 Medium EPSS 1.2% · top 30.7% CWE-79 · Cross-site scripting

6.1CVSS 3.0 base score, v2 4.3

1.2%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

6References

17 Jun 2026Last modified by NVD

Description

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Prime Service Catalog Cisco

References

Link	Tags
http://www.securityfocus.com/bid/96917	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1038045
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-psc	Vendor Advisory
http://www.securityfocus.com/bid/96917	Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1038045
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-psc	Vendor Advisory

Track CVE-2017-3866 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2021-44228Apache Log4j2 JNDI lookup remote code executionApache Log4j2 versions 2.0-beta9 through 2.15.0 (excluding 2.12.2, 2.12.3, and 2.3.1) do not protect against attacker-controlled LDAP and other JNDI …KEVEPSS 100%analysed10 Dec 2021 8.8CVE-2019-1874Cisco prime service catalog cross-site request forgery vulnerabilityA vulnerability in the web-based management interface of Cisco Prime Service Catalog Software could allow an unauthenticated, remote attacker to cond…EPSS 0.80%20 Jun 2019 8.8CVE-2018-0107Cisco prime service catalog cross-site request forgery vulnerabilityA vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unwanted actions on an…EPSS 0.83%18 Jan 2018 7.5CVE-2015-0581Cisco prime service catalog vulnerabilityThe XML parser in Cisco Prime Service Catalog before 10.1 allows remote authenticated users to read arbitrary files or cause a denial of service (CPU…EPSS 2.4%28 Jan 2015 6.5CVE-2022-20680Cisco prime service catalog information exposure vulnerabilityA vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to access sensitiv…EPSS 1.1%10 Feb 2022 6.5CVE-2018-0285Cisco prime service catalog uncontrolled resource consumption vulnerabilityA vulnerability in service logging for Cisco Prime Service Catalog could allow an authenticated, remote attacker to deny service to the user interfac…EPSS 2.6%2 May 2018 6.5CVE-2017-12364Cisco prime service catalog sql injection vulnerabilityA SQL Injection vulnerability in the web framework of Cisco Prime Service Catalog could allow an unauthenticated, remote attacker to execute unauthor…EPSS 1.3%30 Nov 2017 6.5CVE-2015-6395Cisco prime service catalog permissions and access controls vulnerabilityCisco Prime Service Catalog 10.0, 10.0(R2), 10.1, and 11.0 does not properly restrict access to web pages, which allows remote attackers to modify th…EPSS 1.5%12 Dec 2015

Source: NIST National Vulnerability Database (record CVE-2017-3866), CISA KEV, FIRST EPSS (scores of 2026-11-12). This page is refreshed as NVD updates the record.