PT-2017-17258 · Cisco · Cisco Prime Collaboration Provisioning

Published 2017-07-04 · Updated 2017-07-07 · CVE-2017-6704

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Prime Collaboration Provisioning tool version 12.1

Description A vulnerability in the web application could allow an authenticated, remote attacker to perform arbitrary file downloads, potentially allowing the attacker to read files from the underlying filesystem.

Recommendations For version 12.1, update to a version that fixes the issue, as the current version allows arbitrary file downloads that could compromise the system's security.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-6704

Affected Products

Cisco Prime Collaboration Provisioning

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-6704 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-pcp2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-6704 · Vendor Advisory
• http://securityfocus.com/bid/99223 · Note
• http://securitytracker.com/id/1038744 · Note