Read the docs
TI-2017-04380 Aliases CVE-2017-6621GHSA-jv3h-mvmw-qgrw

Information disclosure in Cisco Prime Collaboration

Priority MEDIUM 42CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to access sensitive data. The attacker could use this information to conduct additional reconnaissance attacks. The vulnerability is due to insufficient protection of sensitive data when responding to an HTTP request on the web interface. An attacker could exploit the vulnerability by sending a crafted HTTP request to the application to access specific system files. An exploit could allow the attacker to obtain sensitive information about the application which could include user credentials. This vulnerability affects Cisco Prime Collaboration Provisioning Software Releases 10.6 through 11.5. Cisco Bug IDs: CSCvc99626.

Why it matters now

EPSS 0.06174 93rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Cisco Prime CollaborationCisco Prime Collaboration—No fix listedCNA
  • Cisco Prime Collaboration Vendor— Affected Cisco Prime Collaboration Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:cisco:prime_collaboration_provisioning:9.0.0:*:*:*:*:*:*:*9.0.0VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:9.5.0:*:*:*:*:*:*:*9.5.0VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:10.0.0:*:*:*:*:*:*:*10.0.0VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:10.5.0:*:*:*:*:*:*:*10.5.0VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:10.5.1:*:*:*:*:*:*:*10.5.1VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:10.6.0:*:*:*:*:*:*:*10.6.0VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:10.6.2:*:*:*:*:*:*:*10.6.2VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:11.0.0:*:*:*:*:*:*:*11.0.0VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:11.1.0:*:*:*:*:*:*:*11.1.0VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:11.5.0:*:*:*:*:*:*:*11.5.0VulnerableCisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:9.0.0:*:*:*:*:*:*:* Versions 9.0.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:9.5.0:*:*:*:*:*:*:* Versions 9.5.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:10.0.0:*:*:*:*:*:*:* Versions 10.0.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:10.5.0:*:*:*:*:*:*:* Versions 10.5.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:10.5.1:*:*:*:*:*:*:* Versions 10.5.1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:10.6.0:*:*:*:*:*:*:* Versions 10.6.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:10.6.2:*:*:*:*:*:*:* Versions 10.6.2 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:11.0.0:*:*:*:*:*:*:* Versions 11.0.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:11.1.0:*:*:*:*:*:*:* Versions 11.1.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:11.5.0:*:*:*:*:*:*:* Versions 11.5.0 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-6621
  2. 2026-10-03 Alias added: GHSA-jv3h-mvmw-qgrw

References

Other 1

  • TI-2017-04381 Access control flaw in Cisco Prime Collaboration Provisioning CVSS 3.0CRITICAL 9.8
  • TI-2018-00279 SQL injection in Cisco Prime Collaboration Provisioning unknown CVSS 3.0CRITICAL 9.8
  • TI-2018-00280 Improper authentication in Cisco Prime Collaboration Provisioning unknown CVSS 3.0CRITICAL 9.8
  • TI-2018-00278 Credentials management flaw in Cisco Prime Collaboration Provisioning unknown CVSS 3.0CRITICAL 9.8
  • TI-2018-00277 Credentials management flaw in Cisco Prime Collaboration Provisioning unknown CVSS 3.0CRITICAL 9.8
  • TI-2016-01305 Cisco Prime Collaboration Provisioning 10.6 SP2 (aka 10.6.0.10602) mishandles LDAP… CVSS 3.0CRITICAL 9.8
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences