Read the docs
TI-2017-04381 Aliases CVE-2017-6622GHSA-9vgq-7248-h4mj

Access control flaw in Cisco Prime Collaboration Provisioning

Priority HIGH 77CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass authentication and perform command injection with root privileges. The vulnerability is due to missing security constraints in certain HTTP request methods, which could allow access to files via the web interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the targeted application. This vulnerability affects Cisco Prime Collaboration Provisioning Software Releases prior to 12.1. Cisco Bug IDs: CSCvc98724.

Why it matters now

EPSS 0.6217 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Cisco Prime Collaboration ProvisioningCisco Prime Collaboration Provisioning—No fix listedCNA
  • Cisco Prime Collaboration Provisioning Vendor— Affected Cisco Prime Collaboration Provisioning Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:cisco:prime_collaboration_provisioning:9.0.0:*:*:*:*:*:*:*9.0.0VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:9.5.0:*:*:*:*:*:*:*9.5.0VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:10.0.0:*:*:*:*:*:*:*10.0.0VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:10.5.0:*:*:*:*:*:*:*10.5.0VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:10.5.1:*:*:*:*:*:*:*10.5.1VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:10.6.0:*:*:*:*:*:*:*10.6.0VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:10.6.2:*:*:*:*:*:*:*10.6.2VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:11.0.0:*:*:*:*:*:*:*11.0.0VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:11.1.0:*:*:*:*:*:*:*11.1.0VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:11.5.0:*:*:*:*:*:*:*11.5.0VulnerableCisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:9.0.0:*:*:*:*:*:*:* Versions 9.0.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:9.5.0:*:*:*:*:*:*:* Versions 9.5.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:10.0.0:*:*:*:*:*:*:* Versions 10.0.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:10.5.0:*:*:*:*:*:*:* Versions 10.5.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:10.5.1:*:*:*:*:*:*:* Versions 10.5.1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:10.6.0:*:*:*:*:*:*:* Versions 10.6.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:10.6.2:*:*:*:*:*:*:* Versions 10.6.2 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:11.0.0:*:*:*:*:*:*:* Versions 11.0.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:11.1.0:*:*:*:*:*:*:* Versions 11.1.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:11.5.0:*:*:*:*:*:*:* Versions 11.5.0 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-6622
  2. 2026-10-03 Alias added: GHSA-9vgq-7248-h4mj

References

Exploit 1

Advisory 1

  • TI-2018-00279 SQL injection in Cisco Prime Collaboration Provisioning unknown CVSS 3.0CRITICAL 9.8
  • TI-2018-00280 Improper authentication in Cisco Prime Collaboration Provisioning unknown CVSS 3.0CRITICAL 9.8
  • TI-2018-00278 Credentials management flaw in Cisco Prime Collaboration Provisioning unknown CVSS 3.0CRITICAL 9.8
  • TI-2018-00277 Credentials management flaw in Cisco Prime Collaboration Provisioning unknown CVSS 3.0CRITICAL 9.8
  • TI-2016-01305 Cisco Prime Collaboration Provisioning 10.6 SP2 (aka 10.6.0.10602) mishandles LDAP… CVSS 3.0CRITICAL 9.8
  • TI-2018-00281 Access control flaw in Cisco Prime Collaboration Provisioning unknown CVSS 3.0HIGH 8.8
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences