Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2017-14357: HP ArcSight ESM permits malicious script injection
CVE-2017-14357 · published 9 years ago
Summary
Both HP ArcSight Enterprise Security Manager and its Express version, in any 6.x release before the specified patches, can let attackers insert harmful code into web pages. This could let an attacker run scripts in a user’s browser, potentially stealing data or performing actions on behalf of the user. Update to the latest patches or upgrade to a newer version to block this risk.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| hp | arcsight_enterprise_security_manager |
6.0 6.0c 6.5 6.5c 6.8 6.8c 6.9.0c 6.9.1c 6.11.0 cpe:2.3:a:hp:arcsight_enterprise_security_manager:6.0:*:*:*:*:*:*:* |
| hp | arcsight_enterprise_security_manager_express |
6.0 6.0c 6.5 6.5c 6.8 6.8c 6.9.0 6.9.0c 6.9.1c 6.11.0 cpe:2.3:a:hp:arcsight_enterprise_security_manager_express:6.0:*:*:*:*:*:*:* |
Original advisory text
A Reflected and Stored Cross-Site Scripting (XSS) vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. This vulnerability coul...
A Reflected and Stored Cross-Site Scripting (XSS) vulnerability in HP ArcSight ESM and HP ArcSight ESM Express, in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. This vulnerability could be exploited remotely to allow Reflected and Stored Cross-Site Scripting (XSS)
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published31 Oct 2017
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-14357 · NVD
Track software like this
Free during beta