CVE-2017-6622
CriticalSummary
A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass authentication and perform command injection with root privileges. The vulnerability is due to missing security constraints in certain HTTP request methods.
Risk Assessment
An attacker could exploit this vulnerability to access files via the web interface, posing a serious threat to the security of the system and the organization's data.
Recommendation
It is recommended to update Cisco Prime Collaboration Provisioning software to version 12.1 or later to mitigate this vulnerability.
Original NVD description (English source)
A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass authentication and perform command injection with root privileges. The vulnerability is due to missing security constraints in certain HTTP request methods, which could allow access to files via the web interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the targeted application. This vulnerability affects Cisco Prime Collaboration Provisioning Software Releases prior to 12.1. Cisco Bug IDs: CSCvc98724.