PT-2017-17298 · Cisco · Cisco Prime Collaboration Provisioning Tool

Publicado 2017-08-07 · Atualizado 2019-10-09 · CVE-2017-6759

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Cisco Prime Collaboration Provisioning Tool version 12.1

Description A vulnerability in the UpgradeManager could allow an authenticated, remote attacker to write arbitrary files as root on the system due to insufficient input validation. An attacker could exploit this by triggering the upgrade package installation functionality.

Recommendations For Cisco Prime Collaboration Provisioning Tool version 12.1, update the software to a version that includes the fix for the issue, as the current version allows attackers to write arbitrary files as root due to insufficient input validation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-6759

Produtos afetados

Cisco Prime Collaboration Provisioning Tool

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-6759 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-6759 · Aviso do Fabricante
• http://securitytracker.com/id/1039062 · Nota
• https://quickview.cloudapps.cisco.com/quickview/bug/CSCvc90304 · Aviso do Fabricante
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-pcpt · Aviso do Fabricante