PT-2017-17192 · Cisco · Cisco Prime Collaboration Provisioning

Publicado 2017-05-18 · Atualizado 2017-07-08 · CVE-2017-6621

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Prime Collaboration Provisioning versions 10.6 through 11.5

Description A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. This is due to insufficient protection of sensitive data when responding to an HTTP request on the web interface. An attacker could exploit the vulnerability by sending a crafted HTTP request to access specific system files, potentially obtaining sensitive information about the application, including user credentials.

Recommendations For versions 10.6 through 11.5, update to a version that includes the fix for the issue, as specified in Cisco Bug IDs. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-6621

ZDI-17-447

Produtos afetados

Cisco Prime Collaboration Provisioning

Referências · 6

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-pcp2 · Nota
• http://securityfocus.com/bid/98522 · Nota
• https://zerodayinitiative.com/advisories/ZDI-17-447 · Nota de Segurança
• http://securitytracker.com/id/1038508 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-6621 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-6621 · Aviso do Fabricante