CVE-2017-6636

Cisco Prime Collaboration Provisioning Logs Directory Improper Access Control Information Disclosure Vulnerability

Severity Score

6.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 11.1) could allow an authenticated, remote attacker to view any file on an affected system. The vulnerability exists because the affected software does not perform proper input validation of HTTP requests and fails to apply role-based access controls (RBACs) to requested HTTP URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request that uses directory traversal techniques to submit a path to a desired file location on an affected system. A successful exploit could allow the attacker to view any file on the system. Cisco Bug IDs: CSCvc99604.

Una vulnerabilidad en la interfaz web de Prime Collaboration Provisioning Software de Cisco (versiones anteriores a 11.1) podría permitir a un atacante autenticado remoto visualizar cualquier archivo en un sistema afectado. La vulnerabilidad se presenta porque el programa afectado no realiza la comprobación de entrada apropiada de las peticiones HTTP y no aplica los controles de acceso basados en roles (RBAC) a las URL HTTP pedidas. Un atacante podría explotar esta vulnerabilidad mediante el envío de una petición HTTP diseñada que utiliza técnicas de salto de directorio para enviar una ruta (path) a la ubicación de archivo deseada en un sistema afectado. Una explotación con éxito podría permitir al atacante visualizar cualquier archivo en el sistema. IDs de Bug de Cisco: CSCvc99604.

This vulnerability allows disclose sensitive information on vulnerable installations of Cisco Prime Collaboration Provisioning. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the service that listens on TCP port 443 by default. Access to the /logs/cupm directory is unrestricted. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root.

*Credits: rgod

CVSS Scores

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

Single

Confidentiality

Partial

Integrity

None

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

None

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2017-03-09 CVE Reserved
2017-05-22 CVE Published
2024-08-05 CVE Updated
2024-11-01 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CAPEC

References (3)

URL	Tag	Source
http://www.securityfocus.com/bid/98526	Third Party Advisory
http://www.securitytracker.com/id/1038515	Vdb Entry

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-pcp4	2017-07-08

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Cisco Search vendor "Cisco"		Prime Collaboration Provisioning Search vendor "Cisco" for product "Prime Collaboration Provisioning"				9.0.0 Search vendor "Cisco" for product "Prime Collaboration Provisioning" and version "9.0.0"		-		Affected
Cisco Search vendor "Cisco"		Prime Collaboration Provisioning Search vendor "Cisco" for product "Prime Collaboration Provisioning"				9.5.0 Search vendor "Cisco" for product "Prime Collaboration Provisioning" and version "9.5.0"		-		Affected
Cisco Search vendor "Cisco"		Prime Collaboration Provisioning Search vendor "Cisco" for product "Prime Collaboration Provisioning"				10.0.0 Search vendor "Cisco" for product "Prime Collaboration Provisioning" and version "10.0.0"		-		Affected
Cisco Search vendor "Cisco"		Prime Collaboration Provisioning Search vendor "Cisco" for product "Prime Collaboration Provisioning"				10.5.0 Search vendor "Cisco" for product "Prime Collaboration Provisioning" and version "10.5.0"		-		Affected
Cisco Search vendor "Cisco"		Prime Collaboration Provisioning Search vendor "Cisco" for product "Prime Collaboration Provisioning"				10.5.1 Search vendor "Cisco" for product "Prime Collaboration Provisioning" and version "10.5.1"		-		Affected
Cisco Search vendor "Cisco"		Prime Collaboration Provisioning Search vendor "Cisco" for product "Prime Collaboration Provisioning"				10.6.0 Search vendor "Cisco" for product "Prime Collaboration Provisioning" and version "10.6.0"		-		Affected
Cisco Search vendor "Cisco"		Prime Collaboration Provisioning Search vendor "Cisco" for product "Prime Collaboration Provisioning"				10.6.2 Search vendor "Cisco" for product "Prime Collaboration Provisioning" and version "10.6.2"		-		Affected
Cisco Search vendor "Cisco"		Prime Collaboration Provisioning Search vendor "Cisco" for product "Prime Collaboration Provisioning"				11.0.0 Search vendor "Cisco" for product "Prime Collaboration Provisioning" and version "11.0.0"		-		Affected