CVE-2017-3884
Summary
| CVE | CVE-2017-3884 |
|---|---|
| State | PUBLISHED |
| Assigner | cisco |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-04-07 17:59:00 UTC |
| Updated | 2025-04-20 01:37:25 UTC |
| Description | A vulnerability in the web interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to access sensitive data. The attacker does not need administrator credentials and could use this information to conduct additional reconnaissance attacks. More Information: CSCvc60031 (Fixed) CSCvc60041 (Fixed) CSCvc60095 (Open) CSCvc60102 (Open). Known Affected Releases: 2.2 2.2(3) 3.0 3.1(0.0) 3.1(0.128) 3.1(4.0) 3.1(5.0) 3.2(0.0) 2.0(4.0.45D). |
Risk And Classification
Primary CVSS: v3.0 6.5 MEDIUM from [email protected]
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Problem Types: CWE-200 | Information Disclosure Vulnerability
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 6.5 | MEDIUM | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| 2.0 | [email protected] | Primary | 4 | AV:N/AC:L/Au:S/C:P/I:N/A:N |
CVSS v3.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
SingleConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:L/Au:S/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Cisco | Evolved Programmable Network Manager | 2.0\(4.0.45d\) | All | All | All |
| Application | Cisco | Prime Infrastructure | 2.2 | All | All | All |
| Application | Cisco | Prime Infrastructure | 2.2\(3\) | All | All | All |
| Application | Cisco | Prime Infrastructure | 3.0 | All | All | All |
| Application | Cisco | Prime Infrastructure | 3.1 | All | All | All |
| Application | Cisco | Prime Infrastructure | 3.1\(0.128\) | All | All | All |
| Application | Cisco | Prime Infrastructure | 3.1\(4.0\) | All | All | All |
| Application | Cisco | Prime Infrastructure | 3.1\(5.0\) | All | All | All |
| Application | Cisco | Prime Infrastructure | 3.2\(0.0\) | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Na | Cisco Prime Infrastructure And Cisco Evolved Programmable Network Manager | affected Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Cisco Prime Infrastructure HTTP Request Processing Flaw Lets Remote Authenticated Users Obtain Potentially Sensitive Information - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| Multiple Cisco Products CVE-2017-3884 Information Disclosure Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Third Party Advisory, VDB Entry |
| Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Web Interface Information Disclosure Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | tools.cisco.com | Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.