CVE-2017-6621
published 2017-05-18CVE-2017-6621: A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access sensitive data. The…
PriorityP349high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EPSS
6.17%
92.7th percentile
A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to insufficient protection of sensitive data when responding to an HTTP request on the web interface. An attacker could exploit the vulnerability by sending a crafted HTTP request to the application to access specific system files. An exploit could allow the attacker to obtain sensitive information about the application which could include user credentials. This vulnerability affects Cisco Prime Collaboration Provisioning Software Releases 10.6 through 11.5. Cisco Bug IDs: CSCvc99626.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | prime_collaboration_provisioning | — | — |
| cisco | prime_collaboration_provisioning | — | — |
| cisco | prime_collaboration_provisioning | — | — |
| cisco | prime_collaboration_provisioning | — | — |
| cisco | prime_collaboration_provisioning | — | — |
| cisco | prime_collaboration_provisioning | — | — |
| cisco | prime_collaboration_provisioning | — | — |
| cisco | prime_collaboration_provisioning | — | — |
| cisco | prime_collaboration_provisioning | — | — |
| cisco | prime_collaboration_provisioning | — | — |
| cisco | prime_collaboration_provisioning | — | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_cisco7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-jv3h-mvmw-qgrw: A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access sensitive dat
ghsa_unreviewed·2022-05-17
CVE-2017-6621 [HIGH] CWE-200 GHSA-jv3h-mvmw-qgrw: A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access sensitive dat
A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to insufficient protection of sensitive data when responding to an HTTP request on the web interface. An attacker could exploit the vulnerability by sending a crafted HTTP request to the application to access specific system files. An exploit could allow the attacker to obtain sensitive information about the application which could include user credentials. This vulnerability affects Cisco Prime Collaboration Provisioning Software Releases 10.6 through 11.5. Cisco Bug IDs: CSCvc99626.
Cisco
Cisco Prime Collaboration Provisioning Information Disclosure Vulnerability
vendor_cisco·2017-05-17·CVSS 7.5
CVE-2017-6621 [HIGH] CWE-200 Cisco Prime Collaboration Provisioning Information Disclosure Vulnerability
Cisco Prime Collaboration Provisioning Information Disclosure Vulnerability
A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks.
The vulnerability is due to insufficient protection of sensitive data when responding to an HTTP request on the web interface. An attacker could exploit the vulnerability by sending a crafted HTTP request to the application to access specific system files. An exploit could allow the attacker to obtain sensitive information about the application which could include user credentials.
Cisco has released software updates that address this vulnerability. There are no workarounds tha
Cisco
Cisco Prime Collaboration Provisioning Information Disclosure Vulnerability
vendor_cisco·CVSS 3.0
CVE-2017-6621 Cisco Prime Collaboration Provisioning Information Disclosure Vulnerability
CVE-2017-6621: Cisco Prime Collaboration Provisioning Information Disclosure Vulnerability
A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to insufficient protection of sensitive data when responding to an HTTP request on the web interface. An attacker could exploit the vulnerability by sending a crafted HTTP request to the application to access specific system files. An exploit could allow the attacker to obtain sensitive information about the application which could include user credentials. Cisco has released software updates that address this vulnerability. There are no
CVS
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/98522http://www.securitytracker.com/id/1038508https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-pcp2http://www.securityfocus.com/bid/98522http://www.securitytracker.com/id/1038508https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-pcp2
2017-05-18
Published