CVE-2017-6636

CWE-22 — Path Traversal4 documents4 sources
Severity
6.5MEDIUM
EPSS
3.8%
top 11.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Prime Collaboration Provisioning
Timeline
PublishedMay 22
Latest updateMay 17

Description

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 11.1) could allow an authenticated, remote attacker to view any file on an affected system. The vulnerability exists because the affected software does not perform proper input validation of HTTP requests and fails to apply role-based access controls (RBACs) to requested HTTP URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request that uses directory traversal te…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5cisco_prime_collaboration_provisioningCisco Prime Collaboration Provisioning

🔴Vulnerability Details

2
GHSA
GHSA-x379-2rh4-mvpr: A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 11↗2022-05-17
▶
CVEList
CVE-2017-6636: A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 11↗2017-05-22
▶

📋Vendor Advisories

1
Cisco
Cisco Prime Collaboration Provisioning Directory Traversal Information Disclosure Vulnerability↗2017-05-17
▶
CVE-2017-6636 (MEDIUM CVSS 6.5) | A vulnerability in the web interfac | cvebase.io