PatchSiren cyber security CVE debrief
CVE-2017-3845 Cisco CVE debrief
Cisco Prime Collaboration Assurance contains a cross-site scripting (XSS) flaw in its web-based management interface. An unauthenticated remote attacker could trigger the issue against a user of the interface. Cisco lists versions 11.0, 11.1, and 11.5 as affected; versions prior to 11.0 are not vulnerable.
- Vendor
- Cisco
- Product
- Prime Collaboration Assurance
- CVSS
- MEDIUM 6.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2017-02-22
- Original CVE updated
- 2026-05-13
- Advisory published
- 2017-02-22
- Advisory updated
- 2026-05-13
Who should care
Administrators and security teams responsible for Cisco Prime Collaboration Assurance, especially environments where the web-based management interface is reachable by trusted users or broader networks.
Technical summary
NVD describes CVE-2017-3845 as a network-reachable XSS issue with no authentication required and user interaction required (CVSS v3.0: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The weakness is mapped to CWE-79. The affected Cisco Prime Collaboration Assurance versions listed in the supplied data are 11.0.0, 11.1.0, and 11.5.0.
Defensive priority
Moderate; prioritize faster remediation if the management UI is widely accessible, used by privileged operators, or exposed outside a tightly controlled admin network.
Recommended defensive actions
- Upgrade Cisco Prime Collaboration Assurance to a non-vulnerable release identified by Cisco.
- Restrict access to the web-based management interface to trusted administrative networks only.
- Review administrative sessions and browser usage paths where injected content could be rendered to users.
- Apply least-privilege access and monitor for unexpected script/content injection in the management UI.
- Use the Cisco advisory and NVD entry to confirm the vendor’s remediation guidance for your deployment.
Evidence notes
The supplied NVD record states the vulnerability is in Cisco Prime Collaboration Assurance and maps it to CWE-79 with CVSS v3.0 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The record also lists affected CPE versions 11.0.0, 11.1.0, and 11.5.0, and notes that versions prior to 11.0 are not vulnerable. Cisco’s advisory is cited in the NVD references.
Sources and references
Verified primary and authoritative sources
-
CVE-2017-3845 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2017-3845
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2017-3845 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2017-3845
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Mitigation or vendor reference
Unverified legacy reference
URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170215-pcp3
[email protected] - Vendor Advisory
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.