{"api_version":"1","generated_at":"2026-07-23T11:05:44+00:00","cve":"CVE-2017-6704","urls":{"html":"https://cve.report/CVE-2017-6704","api":"https://cve.report/api/cve/CVE-2017-6704.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-6704","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-6704"},"summary":{"title":"CVE-2017-6704","description":"A vulnerability in the web application in the Cisco Prime Collaboration Provisioning tool could allow an authenticated, remote attacker to perform arbitrary file downloads that could allow the attacker to read files from the underlying filesystem. More Information: CSCvc90335. Known Affected Releases: 12.1.","state":"PUBLISHED","assigner":"cisco","published_at":"2017-07-04 00:29:00","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-22","Arbitrary File Download Vulnerability"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"6.5","severity":"MEDIUM","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4","severity":"","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.securitytracker.com/id/1038744","name":"http://www.securitytracker.com/id/1038744","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Cisco Prime Collaboration Provisioning Tool Bugs Let Remote Users Hijack Sessions, Remote Authenticated Users Download Files, and Local Users Obtain Potentially Sensitive Information - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-pcp2","name":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-pcp2","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Cisco Prime Collaboration Provisioning Tool Arbitrary File Download Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/99223","name":"http://www.securityfocus.com/bid/99223","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Cisco Prime Collaboration Provisioning CVE-2017-6704 Arbitrary File Download Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-6704","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-6704","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"Cisco Prime Collaboration Provisioning Tool","version":"affected Cisco Prime Collaboration Provisioning Tool","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"6704","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"prime_collaboration_provisioning","cpe6":"12.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-05T15:41:16.684Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"1038744","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1038744"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-pcp2"},{"name":"99223","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/99223"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"Cisco Prime Collaboration Provisioning Tool","vendor":"n/a","versions":[{"status":"affected","version":"Cisco Prime Collaboration Provisioning Tool"}]}],"datePublic":"2017-07-03T00:00:00.000Z","descriptions":[{"lang":"en","value":"A vulnerability in the web application in the Cisco Prime Collaboration Provisioning tool could allow an authenticated, remote attacker to perform arbitrary file downloads that could allow the attacker to read files from the underlying filesystem. More Information: CSCvc90335. Known Affected Releases: 12.1."}],"problemTypes":[{"descriptions":[{"description":"Arbitrary File Download Vulnerability","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-06T09:57:01.000Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","shortName":"cisco"},"references":[{"name":"1038744","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1038744"},{"tags":["x_refsource_CONFIRM"],"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-pcp2"},{"name":"99223","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/99223"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@cisco.com","ID":"CVE-2017-6704","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Cisco Prime Collaboration Provisioning Tool","version":{"version_data":[{"version_value":"Cisco Prime Collaboration Provisioning Tool"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A vulnerability in the web application in the Cisco Prime Collaboration Provisioning tool could allow an authenticated, remote attacker to perform arbitrary file downloads that could allow the attacker to read files from the underlying filesystem. More Information: CSCvc90335. Known Affected Releases: 12.1."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Arbitrary File Download Vulnerability"}]}]},"references":{"reference_data":[{"name":"1038744","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1038744"},{"name":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-pcp2","refsource":"CONFIRM","url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-pcp2"},{"name":"99223","refsource":"BID","url":"http://www.securityfocus.com/bid/99223"}]}}}},"cveMetadata":{"assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","assignerShortName":"cisco","cveId":"CVE-2017-6704","datePublished":"2017-07-04T00:00:00.000Z","dateReserved":"2017-03-09T00:00:00.000Z","dateUpdated":"2024-08-05T15:41:16.684Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-07-04 00:29:00","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-22","Arbitrary File Download Vulnerability"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","baseScore":6.5,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:N/A:N","baseScore":4,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:prime_collaboration_provisioning:12.1:*:*:*:*:*:*:*","matchCriteriaId":"FA9198A5-1367-495C-9305-3D4D0D462D49"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"6704","Ordinal":"1","Title":"CVE-2017-6704","CVE":"CVE-2017-6704","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"6704","Ordinal":"1","NoteData":"A vulnerability in the web application in the Cisco Prime Collaboration Provisioning tool could allow an authenticated, remote attacker to perform arbitrary file downloads that could allow the attacker to read files from the underlying filesystem. More Information: CSCvc90335. Known Affected Releases: 12.1.","Type":"Description","Title":"CVE-2017-6704"},{"CveYear":"2017","CveId":"6704","Ordinal":"2","NoteData":"2017-07-03","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"6704","Ordinal":"3","NoteData":"2017-07-06","Type":"Other","Title":"Modified"}]}}}