Cisco Prime Collaboration Provisioning CVE-2017-6636 Directory Traversal Vulnerability

Bugtraq ID:	98526
Class:	Input Validation Error
CVE:	CVE-2017-6636
Remote:	Yes
Local:	No
Published:	May 17 2017 12:00AM
Updated:	May 17 2017 12:00AM
Credit:	rgod, working with Trend Micro Zero Day Initiative
Vulnerable:	Cisco Prime Collaboration Provisioning 11.0 Cisco Prime Collaboration Provisioning 10.6 Cisco Prime Collaboration Provisioning 10.5 Cisco Prime Collaboration Provisioning 10.0
Not Vulnerable:	Cisco Prime Collaboration Provisioning 11.1

Cisco Prime Collaboration Provisioning CVE-2017-6636 Directory Traversal Vulnerability

Cisco Prime Collaboration Provisioning is prone to a directory-traversal vulnerability.

Exploiting this issue can allow an attacker to gain read access to arbitrary files. Information harvested may aid in launching further attacks.

Versions prior to Cisco Prime Collaboration Provisioning 11.1 are vulnerable.

This issue is tracked by Cisco Bug ID CSCvc99604.

Cisco Prime Collaboration Provisioning CVE-2017-6636 Directory Traversal Vulnerability

An attacker can exploit this issue using a web browser.

Cisco Prime Collaboration Provisioning CVE-2017-6636 Directory Traversal Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Cisco Prime Collaboration Provisioning CVE-2017-6636 Directory Traversal Vulnerability

References:

• Cisco Homepage (Cisco )
  
• cisco-sa-20170517-pcp4 : Cisco Prime Collaboration Provisioning Directory Traver (Cisco)