← Vulnerability feed

Vulnerability record · CVE-2017-6621 · published 18 May 2017

CVE-2017-6621: Cisco prime collaboration provisioning information exposure vulnerability

Cisco · Prime Collaboration Provisioning

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to insufficient protection of sensitive data when responding to an HTTP request on the web interface. An attacker could exploit the vulnerability by sending a crafted HTTP request to the application to access specific system files. An exploit could allow the attacker to obtain sensitive information about the application which could include user credentials. This vulnerability affects Cisco Prime Collaboration Provisioning Software Releases 10.6 through 11.5. Cisco Bug IDs: CSCvc99626.

7.5 CVSS 3.0 High EPSS 6.2% · top 6.8% CWE-200 · Information exposure
7.5CVSS 3.0 base score, v2 5.0
6.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to insufficient protection of sensitive data when responding to an HTTP request on the web interface. An attacker could exploit the vulnerability by sending a crafted HTTP request to the application to access specific system files. An exploit could allow the attacker to obtain sensitive information about the application which could include user credentials. This vulnerability affects Cisco Prime Collaboration Provisioning Software Releases 10.6 through 11.5. Cisco Bug IDs: CSCvc99626.

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/98522 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1038508
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-pcp2 VDB Entry
http://www.securityfocus.com/bid/98522 Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1038508
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-pcp2 VDB Entry

Track CVE-2017-6621 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-0318Cisco prime collaboration improper authentication vulnerabilityA vulnerability in the password reset function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to gai…EPSS 3.1%9.8CVE-2018-0319Cisco prime collaboration improper authentication vulnerabilityA vulnerability in the password recovery function of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to …EPSS 3.1%9.8CVE-2018-0320Cisco prime collaboration sql injection vulnerabilityA vulnerability in the web framework code of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to execute …EPSS 4.0%9.8CVE-2018-0321Cisco prime collaboration improper authentication vulnerabilityA vulnerability in Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to access the Java Remote Method Invo…EPSS 3.6%9.8CVE-2017-6622Cisco Prime Collaboration Provisioning auth bypass and root command injectionCisco Prime Collaboration Provisioning's web interface lacks security constraints on certain HTTP request methods, allowing an unauthenticated remote…EPSS 62%analysed9.8CVE-2016-1416Cisco prime collaboration provisioning permissions and access controls vulnerabilityCisco Prime Collaboration Provisioning 10.6 SP2 (aka 10.6.0.10602) mishandles LDAP authentication, which allows remote attackers to obtain administra…EPSS 4.5%9.0CVE-2015-4307Cisco prime collaboration provisioning permissions and access controls vulnerabilityThe web framework in Cisco Prime Collaboration Provisioning before 11.0 allows remote authenticated users to bypass intended access restrictions and …EPSS 2.6%8.8CVE-2018-0317Cisco prime collaboration permissions and access controls vulnerabilityA vulnerability in the web interface of Cisco Prime Collaboration Provisioning (PCP) could allow an authenticated, remote attacker to escalate their …EPSS 2.6%

Source: NIST National Vulnerability Database (record CVE-2017-6621), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.