Read the docs
TI-2017-04394 Aliases CVE-2017-6635GHSA-j3v9-pq52-4m75

Access control flaw in Cisco Prime Collaboration Provisioning

Priority MEDIUM 41CWE-264Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 12.1) could allow an authenticated, remote attacker to delete any file from an affected system. The vulnerability exists because the affected software does not perform proper input validation of HTTP requests and fails to apply role-based access controls (RBACs) to requested HTTP URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request that uses directory traversal techniques to submit a path to a desired file location on an affected system. A successful exploit could allow the attacker to delete any file from the system. Cisco Bug IDs: CSCvc99597.

Why it matters now

EPSS 0.09729 95th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Cisco Prime Collaboration ProvisioningCisco Prime Collaboration Provisioning—No fix listedCNA
  • Cisco Prime Collaboration Provisioning Vendor— Affected Cisco Prime Collaboration Provisioning Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:cisco:prime_collaboration_provisioning:9.0.0:*:*:*:*:*:*:*9.0.0VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:9.5.0:*:*:*:*:*:*:*9.5.0VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:10.0.0:*:*:*:*:*:*:*10.0.0VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:10.5.0:*:*:*:*:*:*:*10.5.0VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:10.5.1:*:*:*:*:*:*:*10.5.1VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:10.6.0:*:*:*:*:*:*:*10.6.0VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:10.6.2:*:*:*:*:*:*:*10.6.2VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:11.0.0:*:*:*:*:*:*:*11.0.0VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:11.1.0:*:*:*:*:*:*:*11.1.0VulnerableCisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:11.5.0:*:*:*:*:*:*:*11.5.0VulnerableCisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:9.0.0:*:*:*:*:*:*:* Versions 9.0.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:9.5.0:*:*:*:*:*:*:* Versions 9.5.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:10.0.0:*:*:*:*:*:*:* Versions 10.0.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:10.5.0:*:*:*:*:*:*:* Versions 10.5.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:10.5.1:*:*:*:*:*:*:* Versions 10.5.1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:10.6.0:*:*:*:*:*:*:* Versions 10.6.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:10.6.2:*:*:*:*:*:*:* Versions 10.6.2 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:11.0.0:*:*:*:*:*:*:* Versions 11.0.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:11.1.0:*:*:*:*:*:*:* Versions 11.1.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:prime_collaboration_provisioning:11.5.0:*:*:*:*:*:*:* Versions 11.5.0 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-6635
  2. 2026-10-03 Alias added: GHSA-j3v9-pq52-4m75

References

Advisory 1

  • TI-2017-04381 Access control flaw in Cisco Prime Collaboration Provisioning CVSS 3.0CRITICAL 9.8
  • TI-2018-00279 SQL injection in Cisco Prime Collaboration Provisioning unknown CVSS 3.0CRITICAL 9.8
  • TI-2018-00280 Improper authentication in Cisco Prime Collaboration Provisioning unknown CVSS 3.0CRITICAL 9.8
  • TI-2018-00278 Credentials management flaw in Cisco Prime Collaboration Provisioning unknown CVSS 3.0CRITICAL 9.8
  • TI-2018-00277 Credentials management flaw in Cisco Prime Collaboration Provisioning unknown CVSS 3.0CRITICAL 9.8
  • TI-2016-01305 Cisco Prime Collaboration Provisioning 10.6 SP2 (aka 10.6.0.10602) mishandles LDAP… CVSS 3.0CRITICAL 9.8
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences