PT-2017-17258 · Cisco · Cisco Prime Collaboration Provisioning

Publicado 2017-07-04 · Atualizado 2017-07-07 · CVE-2017-6704

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Prime Collaboration Provisioning tool version 12.1

Description A vulnerability in the web application could allow an authenticated, remote attacker to perform arbitrary file downloads, potentially allowing the attacker to read files from the underlying filesystem.

Recommendations For version 12.1, update to a version that fixes the issue, as the current version allows arbitrary file downloads that could compromise the system's security.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2017-6704

Produtos afetados

Cisco Prime Collaboration Provisioning

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-6704 · Nota de Segurança
• http://securityfocus.com/bid/99223 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-pcp2 · Aviso do Fabricante
• http://securitytracker.com/id/1038744 · Nota
• https://osv.dev/vulnerability/CVE-2017-6704 · Aviso do Fabricante