« Volver al listado

CVE-2017-6622

Estado: ModificadaCrítica (9.8)—

A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass authentication and perform command injection with root privileges. The vulnerability is due to missing security constraints in certain HTTP request methods, which could allow access to files via the web interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the targeted application. This vulnerability affects Cisco Prime Collaboration Provisioning Software Releases prior to 12.1. Cisco Bug IDs: CSCvc98724.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cisco — Prime Collaboration Provisioning

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-6622",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": true,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@cisco.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "Cisco Prime Collaboration Provisioning",
          "versions": [
            {
              "status": "affected",
              "version": "Cisco Prime Collaboration Provisioning"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-05-18T19:29:00.237",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/98520",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1038507",
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-pcp1",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@cisco.com"
    },
    {
      "url": "https://www.exploit-db.com/exploits/42888/",
      "source": "psirt@cisco.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/98520",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1038507",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-pcp1",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.exploit-db.com/exploits/42888/",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@cisco.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass authentication and perform command injection with root privileges. The vulnerability is due to missing security constraints in certain HTTP request methods, which could allow access to files via the web interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the targeted application. This vulnerability affects Cisco Prime Collaboration Provisioning Software Releases prior to 12.1. Cisco Bug IDs: CSCvc98724."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en la interfaz web de Cisco Prime Collaboration Provisioning podría permitir que un atacante remoto no autenticado omita la autenticación y realice una inyección de comandos con privilegios root. La vulnerabilidad se debe a la falta de restricciones de seguridad en ciertos métodos de peticiones HTTP, lo que podría permitir el acceso a archivos mediante la interfaz web. Un atacante podría explotar esta vulnerabilidad mediante el envío de una petición HTTP manipulada a la aplicación objetivo. Esta vulnerabilidad afecta a las distribuciones del software Cisco Prime Collaboration Provisioning anteriores a la 12.1. Cisco Bug IDs: CSCvc98724."
    }
  ],
  "lastModified": "2026-06-17T01:22:40.107",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cisco:prime_collaboration_provisioning:9.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "23FBBA67-3E61-4C29-AE29-DA9AC85B130E"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_collaboration_provisioning:9.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ADD5C349-0CCD-4182-8B41-CB199868A318"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_collaboration_provisioning:10.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A8B93578-B8CF-4977-B2D6-3F2420391008"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_collaboration_provisioning:10.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "08D10D0F-159A-4C2A-9ECE-4C55ADE37298"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_collaboration_provisioning:10.5.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D2B13F1-A983-446D-8698-B562801B320B"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_collaboration_provisioning:10.6.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "00D29AB4-BF27-4366-9CC1-060B8C97067A"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_collaboration_provisioning:10.6.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF0F423A-8552-4406-8E42-3C417AEB4A0B"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_collaboration_provisioning:11.0.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F05F7FBB-870A-4978-9F6F-E896472E53AA"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_collaboration_provisioning:11.1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8DF611EA-218D-4231-A7AA-1F795132F90E"
            },
            {
              "criteria": "cpe:2.3:a:cisco:prime_collaboration_provisioning:11.5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "31DC57C2-8870-4663-830F-C6209F47DF06"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@cisco.com"
}