CVE-2017-6704
medium
CVSS v3
6.5
CVSS v2
4.0
VIR risk
6.5
Description
A vulnerability in the web application in the Cisco Prime Collaboration Provisioning tool could allow an authenticated, remote attacker to perform arbitrary file downloads that could allow the attacker to read files from the underlying filesystem. More Information: CSCvc90335. Known Affected Releases: 12.1.
Predictions
Exploit likelihood
75%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: psirt@cisco.com — https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-pcp2
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| cisco | prime_collaboration_provisioning | 12.1 | |
References
- http://www.securityfocus.com/bid/99223
- http://www.securitytracker.com/id/1038744
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-pcp2
- http://www.securityfocus.com/bid/99223
- http://www.securitytracker.com/id/1038744
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-pcp2
CWEs
CWE-22
Verify integrity in audit chain (admin only). AS-IS.