PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-3845 Cisco CVE debrief

Cisco Prime Collaboration Assurance contains a cross-site scripting (XSS) flaw in its web-based management interface. An unauthenticated remote attacker could trigger the issue against a user of the interface. Cisco lists versions 11.0, 11.1, and 11.5 as affected; versions prior to 11.0 are not vulnerable.

Vendor
Cisco
Product
Prime Collaboration Assurance
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-22
Original CVE updated
2026-05-13
Advisory published
2017-02-22
Advisory updated
2026-05-13

Who should care

Administrators and security teams responsible for Cisco Prime Collaboration Assurance, especially environments where the web-based management interface is reachable by trusted users or broader networks.

Technical summary

NVD describes CVE-2017-3845 as a network-reachable XSS issue with no authentication required and user interaction required (CVSS v3.0: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The weakness is mapped to CWE-79. The affected Cisco Prime Collaboration Assurance versions listed in the supplied data are 11.0.0, 11.1.0, and 11.5.0.

Defensive priority

Moderate; prioritize faster remediation if the management UI is widely accessible, used by privileged operators, or exposed outside a tightly controlled admin network.

Recommended defensive actions

  • Upgrade Cisco Prime Collaboration Assurance to a non-vulnerable release identified by Cisco.
  • Restrict access to the web-based management interface to trusted administrative networks only.
  • Review administrative sessions and browser usage paths where injected content could be rendered to users.
  • Apply least-privilege access and monitor for unexpected script/content injection in the management UI.
  • Use the Cisco advisory and NVD entry to confirm the vendor’s remediation guidance for your deployment.

Evidence notes

The supplied NVD record states the vulnerability is in Cisco Prime Collaboration Assurance and maps it to CWE-79 with CVSS v3.0 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The record also lists affected CPE versions 11.0.0, 11.1.0, and 11.5.0, and notes that versions prior to 11.0 are not vulnerable. Cisco’s advisory is cited in the NVD references.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-3845 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-3845

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-3845 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-3845

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.