The WebLaunch functionality of Cisco AnyConnect Secure Mobility Client Software contains a vulnerability that could allow an…

Description

The WebLaunch functionality of Cisco AnyConnect Secure Mobility Client Software contains a vulnerability that could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the affected software. The vulnerability is due to insufficient input validation of some parameters that are passed to the WebLaunch function of the affected software. An attacker could exploit this vulnerability by convincing a user to access a malicious link or by intercepting a user request and injecting malicious code into the request. Cisco Bug IDs: CSCvf12055. Known Affected Releases: 98.89(40).

Scores

EPSS (exploitation in 30 days)

1.2% · top 31% of all CVEs (3 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.1.

Weakness

• Cross-Site Scripting
• CWE-79 (opens in a new tab)All about CWE-79 and its CVEs

Affected products

• Cisco Systems, Inc. · AnyConnect WebLaunch

  • affected 98.89(40)

References (3)

• 100364 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
• 1039190 (opens in a new tab)vdb-entryx_refsource_SECTRACKx_transferred
• 20170816 Cisco AnyConnect WebLaunch Cross-Site Scripting Vulnerability (opens in a new tab)vendor-advisoryx_refsource_CISCOx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2017-6788](https://trackcve.app/badge/CVE-2017-6788.svg)](https://trackcve.app/cve/CVE-2017-6788)

Record last updated 16 Sept 2024, 16:28 UTC.