CVE-2017-6637

CWE-264CWE-20 — Improper Input Validation4 documents4 sources
Severity
6.5MEDIUM
EPSS
1.1%
top 21.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Prime Collaboration Provisioning
Timeline
PublishedMay 22
Latest updateMay 13

Description

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 11.1) could allow an authenticated, remote attacker to delete any file from an affected system. The vulnerability exists because the affected software does not perform proper input validation of HTTP requests and fails to apply role-based access controls (RBACs) to requested HTTP URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request that uses directory traversa…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5cisco_prime_collaboration_provisioningCisco Prime Collaboration Provisioning

🔴Vulnerability Details

2
GHSA
GHSA-55v6-qp6h-3g38: A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 11↗2022-05-13
▶
CVEList
CVE-2017-6637: A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 11↗2017-05-22
▶

📋Vendor Advisories

1
Cisco
Cisco Prime Collaboration Provisioning Directory Traversal Arbitrary File Deletion Vulnerability↗2017-05-17
▶
CVE-2017-6637 (MEDIUM CVSS 6.5) | A vulnerability in the web interfac | cvebase.io