A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access se…

Published 9 y ago 2017-05-18 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.5

v3.0 · NVD

CISA KEV

not known exploited

EPSS

6.2%

percentile 94%

Public exploits

none known

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to insufficient protection of sensitive data when responding to an HTTP request on the web interface. An attacker could exploit the vulnerability by sending a crafted HTTP request to the application to access specific system files. An exploit could allow the attacker to obtain sensitive information about the application which could include user credentials. This vulnerability affects Cisco Prime Collaboration Provisioning Software Releases 10.6 through 11.5. Cisco Bug IDs: CSCvc99626.

Exploit prediction (EPSS)

6.17% probability of exploitation in the next 30 days, higher than 94% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	7.5	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N`
NVD	2.0	5.0	`AV:N/AC:L/Au:N/C:P/I:N/A:N`

Affected products

n/a Cisco Prime Collaboration

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-pcp2 · x_refsource_CONFIRM, x_transferred
securitytracker.com /id/1038508 · vdb-entry, x_refsource_SECTRACK, x_transferred
securityfocus.com /bid/98522 · vdb-entry, x_refsource_BID, x_transferred

Sources

CVE List: CVE-2017-6621
NVD: CVE-2017-6621

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.