Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-3890: BlackBerry WatchDox Server lets malicious link run code

CVE-2017-3890 · published 9 years ago

Summary

The WatchDox Server component in BlackBerry Appliance‑X (up to version 1.8.1) and the vAPP feature (versions 4.6.0 through 5.4.1) can be tricked into running code supplied in a web link. If a user clicks such a link, the attacker’s code runs in the user’s browser, potentially exposing personal or corporate information. Install the latest security updates from BlackBerry and educate users to avoid clicking unexpected links while using these products.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
blackberry	appliance-x	<= 1.8.1 `cpe:2.3:a:blackberry:appliance-x::::::::`
blackberry	workspaces_vapp	4.6.0 5.4.1 `cpe:2.3:a:blackberry:workspaces_vapp:4.6.0:::::::*`

Original advisory text

A reflected cross-site scripting vulnerability in the BlackBerry WatchDox Server components Appliance-X, version 1.8.1 and earlier, and vAPP, versions 4.6.0 to 5.4.1, allows remote attackers to execute script commands in the context of the affected browser by persuading a user to click an attacker-supplied malicious link.

References

http://support.blackberry.com/kb/articleDetail?articleNumber=000038915 Vendor Advisory
http://www.securityfocus.com/bid/95442 Third Party Advisory VDB Entry

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.1 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published13 Jan 2017

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2017-3890 · NVD

Track software like this

Free during beta