CVE-2017-6635: Input Validation
A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 12.1) could allow an authenticated, remote attacker to delete any file from an affected system. The vulnerability exists because the affected software does not perform proper input validation of HTTP requests and fails to apply role-based access controls (RBACs) to requested HTTP URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request that uses directory traversal techniques to submit a path to a desired file location on an affected system. A successful exploit could allow the attacker to delete any file from the system. Cisco Bug IDs: CSCvc99597.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6635?
CVE-2017-6635 has been classified as a high severity vulnerability due to the potential for remote file deletion.
How do I fix CVE-2017-6635?
To fix CVE-2017-6635, upgrade the Cisco Prime Collaboration Provisioning Software to a version that is not affected, such as 12.1 or later.
What versions of Cisco Prime Collaboration Provisioning are affected by CVE-2017-6635?
CVE-2017-6635 affects Cisco Prime Collaboration Provisioning versions 9.0.0 through 11.5.0.
Who can exploit CVE-2017-6635?
CVE-2017-6635 can be exploited by an authenticated remote attacker with access to the web interface.
What can an attacker do with CVE-2017-6635?
An attacker exploiting CVE-2017-6635 can delete any file from the affected Cisco Prime Collaboration Provisioning system.