Lucene search

CiscoCVE-2017-6703

HistoryJul 04, 2017 - 12:29 a.m.

CVE-2017-6703

2017-07-0400:29:00

CWE-287

cisco

web.nvd.nist.gov

cisco

prime collaboration

provisioning

vulnerability

session hijacking

nvd

cscvc90346

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:P/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

AI Score

5.8

Confidence

High

EPSS

0.002

Percentile

56.2%

JSON

A vulnerability in the web application in the Cisco Prime Collaboration Provisioning tool could allow an unauthenticated, remote attacker to hijack another user’s session. More Information: CSCvc90346. Known Affected Releases: 12.1.

Affected configurations

Nvd

Node

ciscoprime_collaboration_provisioningMatch11.2_base

ciscoprime_collaboration_provisioningMatch11.5.0

ciscoprime_collaboration_provisioningMatch11.6_base

ciscoprime_collaboration_provisioningMatch12.1_base

VendorProductVersionCPE
ciscoprime_collaboration_provisioning11.2_basecpe:2.3:a:cisco:prime_collaboration_provisioning:11.2_base:*:*:*:*:*:*:*
ciscoprime_collaboration_provisioning11.5.0cpe:2.3:a:cisco:prime_collaboration_provisioning:11.5.0:*:*:*:*:*:*:*
ciscoprime_collaboration_provisioning11.6_basecpe:2.3:a:cisco:prime_collaboration_provisioning:11.6_base:*:*:*:*:*:*:*
ciscoprime_collaboration_provisioning12.1_basecpe:2.3:a:cisco:prime_collaboration_provisioning:12.1_base:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	prime_collaboration_provisioning	11.2_base	cpe:2.3:a:cisco:prime_collaboration_provisioning:11.2_base:::::::*
cisco	prime_collaboration_provisioning	11.5.0	cpe:2.3:a:cisco:prime_collaboration_provisioning:11.5.0:::::::*
cisco	prime_collaboration_provisioning	11.6_base	cpe:2.3:a:cisco:prime_collaboration_provisioning:11.6_base:::::::*
cisco	prime_collaboration_provisioning	12.1_base	cpe:2.3:a:cisco:prime_collaboration_provisioning:12.1_base:::::::*

CNA Affected

[
  {
    "product": "Cisco Prime Collaboration Provisioning Tool",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Cisco Prime Collaboration Provisioning Tool"
      }
    ]
  }
]

References

www.securityfocus.com/bid/99224

www.securitytracker.com/id/1038744

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-pcp1

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:H/Au:N/C:P/I:P/A:N

CVSS3

5.9

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N

AI Score

5.8

Confidence

High

EPSS

0.002

Percentile

56.2%

JSON

Related for CVE-2017-6703