PT-2017-17192 · Cisco · Cisco Prime Collaboration Provisioning

Published 2017-05-18 · Updated 2017-07-08 · CVE-2017-6621

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Prime Collaboration Provisioning versions 10.6 through 11.5

Description A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. This is due to insufficient protection of sensitive data when responding to an HTTP request on the web interface. An attacker could exploit the vulnerability by sending a crafted HTTP request to access specific system files, potentially obtaining sensitive information about the application, including user credentials.

Recommendations For versions 10.6 through 11.5, update to a version that includes the fix for the issue, as specified in Cisco Bug IDs. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-6621

ZDI-17-447

Affected Products

Cisco Prime Collaboration Provisioning

References · 6

• https://zerodayinitiative.com/advisories/ZDI-17-447 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-6621 · Security Note
• https://osv.dev/vulnerability/CVE-2017-6621 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-pcp2 · Note
• http://securityfocus.com/bid/98522 · Note
• http://securitytracker.com/id/1038508 · Note