PT-2017-17325 · Cisco · Cisco Prime Collaboration Provisioning Tool

Published 2017-09-07 · Updated 2019-10-09 · CVE-2017-6792

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Prime Collaboration Provisioning Tool (affected versions not specified)

Description A vulnerability in the batch provisioning feature could allow an authenticated, remote attacker to overwrite system files as root. This issue is due to a lack of input validation of the parameters in BatchFileName and Directory. An attacker could exploit this by manipulating the parameters of the batch action file function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-6792

Affected Products

Cisco Prime Collaboration Provisioning Tool

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-6792 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170906-pcpt · Vendor Advisory
• http://securityfocus.com/bid/100666 · Note
• http://securitytracker.com/id/1039279 · Note