Read the docs
TI-2017-09116 Aliases CVE-2017-12344GHSA-5ww2-v6pw-8xx5

Cross-site scripting in Cisco Data Center Network Manager Software

Priority LOW 29CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting, Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-79 and CWE-601.

Summary

Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into DCNM configuration parameters, redirect a user to a malicious website, inject malicious content into a DCNM client interface, or conduct a cross-site scripting (XSS) attack against a user of the affected software. Cisco Bug IDs: CSCvf40477, CSCvf63150, CSCvf68218, CSCvf68235, CSCvf68247.

Why it matters now

EPSS 0.00926 60th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Cisco Data Center Network Manager SoftwareCisco Data Center Network Manager Software—No fix listedCNA
  • Cisco Data Center Network Manager Software Vendor— Affected Cisco Data Center Network Manager Software Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cisco:data_center_network_manager:10.2\(1\):*:*:*:*:*:*:*10.2(1)VulnerableCisco
  • cpe:2.3:a:cisco:data_center_network_manager:10.2\(1\):*:*:*:*:*:*:* Versions 10.2(1) Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-12344
  2. 2026-10-03 Alias added: GHSA-5ww2-v6pw-8xx5

References

Advisory 1

  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
  • TI-2019-12015 Cisco Data Center Network Manager Authentication Bypass Vulnerabilities CVSS 3.1CRITICAL 9.8
  • TI-2019-12016 Cisco Data Center Network Manager Authentication Bypass Vulnerabilities CVSS 3.1CRITICAL 9.8
  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2019-01247 Cisco Data Center Network Manager Arbitrary File Upload and Remote Code Execution Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2019-01246 Cisco Data Center Network Manager Authentication Bypass Vulnerability CVSS 3.1CRITICAL 9.8
See all 67 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences