vulnwire
6.5med

CVE-2017-6635

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 12.1) could allow an authenticate…

Published 9 y ago · modified 4 mo ago · JSON

CVSS
6.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
9.7%
percentile 96%
Public exploits
0
none known

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 12.1) could allow an authenticated, remote attacker to delete any file from an affected system. The vulnerability exists because the affected software does not perform proper input validation of HTTP requests and fails to apply role-based access controls (RBACs) to requested HTTP URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request that uses directory traversal techniques to submit a path to a desired file location on an affected system. A successful exploit could allow the attacker to delete any file from the system. Cisco Bug IDs: CSCvc99597.

Exploit prediction (EPSS)

9.73% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.06.5CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD2.06.8AV:N/AC:L/Au:S/C:N/I:C/A:N

Affected products

  • n/a Cisco Prime Collaboration Provisioning

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls
  • CWE-862 Missing Authorization

References

  • securitytracker.com /id/1038514 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-pcp3 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/98535 · vdb-entry, x_refsource_BID, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.