PT-2017-17325 · Cisco · Cisco Prime Collaboration Provisioning Tool

Publicado 2017-09-07 · Atualizado 2019-10-09 · CVE-2017-6792

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Prime Collaboration Provisioning Tool (affected versions not specified)

Description A vulnerability in the batch provisioning feature could allow an authenticated, remote attacker to overwrite system files as root. This issue is due to a lack of input validation of the parameters in BatchFileName and Directory. An attacker could exploit this by manipulating the parameters of the batch action file function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-6792

Produtos afetados

Cisco Prime Collaboration Provisioning Tool

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-6792 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-pcpt · Aviso do Fabricante
• http://securityfocus.com/bid/100666 · Nota
• http://securitytracker.com/id/1039279 · Nota