CVE-2017-6661

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-06-13 · updated 2026-06-17
Weakness: CWE-79

Description

A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA) and Cisco Content Security Management Appliance (SMA) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device, aka Message Tracking XSS. More Information: CSCvd30805 CSCvd34861. Known Affected Releases: 10.0.0-203 10.1.0-049.

Affected products

Cisco Content Security Management Appliance (SMA): 10.0.0-203, 10.1.0-049
Cisco Email Security Appliance (ESA): 10.0.0-203, 10.1.0-049

References

http://www.securityfocus.com/bid/98950
http://www.securitytracker.com/id/1038637
http://www.securitytracker.com/id/1038638
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-esa
http://www.securityfocus.com/bid/98950
http://www.securitytracker.com/id/1038637
http://www.securitytracker.com/id/1038638
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-esa

Get alerted when CVE-2017-6661 or the next vulnerability affects your stack