CVE-2017-6621
Summary
| CVE | CVE-2017-6621 |
|---|---|
| State | PUBLISHED |
| Assigner | cisco |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-05-18 19:29:00 UTC |
| Updated | 2025-04-20 01:37:25 UTC |
| Description | A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to insufficient protection of sensitive data when responding to an HTTP request on the web interface. An attacker could exploit the vulnerability by sending a crafted HTTP request to the application to access specific system files. An exploit could allow the attacker to obtain sensitive information about the application which could include user credentials. This vulnerability affects Cisco Prime Collaboration Provisioning Software Releases 10.6 through 11.5. Cisco Bug IDs: CSCvc99626. |
Risk And Classification
Primary CVSS: v3.0 7.5 HIGH from [email protected]
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Problem Types: CWE-200 | CWE-200 CWE-200
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 7.5 | HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| 2.0 | [email protected] | Primary | 5 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
CVSS v3.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
NoneAvailability
NoneCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
NoneAvailability
NoneAV:N/AC:L/Au:N/C:P/I:N/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Cisco | Prime Collaboration Provisioning | 10.0.0 | All | All | All |
| Application | Cisco | Prime Collaboration Provisioning | 10.5.0 | All | All | All |
| Application | Cisco | Prime Collaboration Provisioning | 10.5.1 | All | All | All |
| Application | Cisco | Prime Collaboration Provisioning | 10.6.0 | All | All | All |
| Application | Cisco | Prime Collaboration Provisioning | 10.6.2 | All | All | All |
| Application | Cisco | Prime Collaboration Provisioning | 11.0.0 | All | All | All |
| Application | Cisco | Prime Collaboration Provisioning | 11.1.0 | All | All | All |
| Application | Cisco | Prime Collaboration Provisioning | 11.5.0 | All | All | All |
| Application | Cisco | Prime Collaboration Provisioning | 9.0.0 | All | All | All |
| Application | Cisco | Prime Collaboration Provisioning | 9.5.0 | All | All | All |
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Na | Cisco Prime Collaboration | affected Cisco Prime Collaboration | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Cisco Prime Collaboration Provisioning Information Disclosure Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | tools.cisco.com | VDB Entry |
| Cisco Prime Collaboration Provisioning CVE-2017-6621 Information Disclosure Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Third Party Advisory, VDB Entry |
| Cisco Prime Collaboration Provisioning Access Control Flaw Lets Remote Users Obtain Potentially Sensitive Information and Passwords on the Target System - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.