CVE-2017-6622 (CNNVD-201705-848)
中文标题:
Cisco Prime Collaboration Provisioning Software 安全漏洞
英文标题:
A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unaut...
漏洞描述
中文描述:
Cisco Prime Collaboration Provisioning Software是美国思科（Cisco）公司的一套基于Web的下一代通信服务软件。该软件对IP电话、语音邮件和统一通信环境提供IP通信服务功能。 Cisco Prime Collaboration Provisioning Software 12.1之前的版本中的Web界面存在身份验证绕过漏洞，该漏洞源于在HTTP请求方法中，程序缺少安全限制。远程攻击者通过向目标应用程序发送特制的HTTP请求利用该漏洞绕过身份验证，以root权限执行命令注入。
英文描述:
A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass authentication and perform command injection with root privileges. The vulnerability is due to missing security constraints in certain HTTP request methods, which could allow access to files via the web interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the targeted application. This vulnerability affects Cisco Prime Collaboration Provisioning Software Releases prior to 12.1. Cisco Bug IDs: CSCvc98724.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| cisco | prime_collaboration_provisioning | 9.0.0 | - | - |
cpe:2.3:a:cisco:prime_collaboration_provisioning:9.0.0:*:*:*:*:*:*:*
|
| cisco | prime_collaboration_provisioning | 9.5.0 | - | - |
cpe:2.3:a:cisco:prime_collaboration_provisioning:9.5.0:*:*:*:*:*:*:*
|
| cisco | prime_collaboration_provisioning | 10.0.0 | - | - |
cpe:2.3:a:cisco:prime_collaboration_provisioning:10.0.0:*:*:*:*:*:*:*
|
| cisco | prime_collaboration_provisioning | 10.5.0 | - | - |
cpe:2.3:a:cisco:prime_collaboration_provisioning:10.5.0:*:*:*:*:*:*:*
|
| cisco | prime_collaboration_provisioning | 10.5.1 | - | - |
cpe:2.3:a:cisco:prime_collaboration_provisioning:10.5.1:*:*:*:*:*:*:*
|
| cisco | prime_collaboration_provisioning | 10.6.0 | - | - |
cpe:2.3:a:cisco:prime_collaboration_provisioning:10.6.0:*:*:*:*:*:*:*
|
| cisco | prime_collaboration_provisioning | 10.6.2 | - | - |
cpe:2.3:a:cisco:prime_collaboration_provisioning:10.6.2:*:*:*:*:*:*:*
|
| cisco | prime_collaboration_provisioning | 11.0.0 | - | - |
cpe:2.3:a:cisco:prime_collaboration_provisioning:11.0.0:*:*:*:*:*:*:*
|
| cisco | prime_collaboration_provisioning | 11.1.0 | - | - |
cpe:2.3:a:cisco:prime_collaboration_provisioning:11.1.0:*:*:*:*:*:*:*
|
| cisco | prime_collaboration_provisioning | 11.5.0 | - | - |
cpe:2.3:a:cisco:prime_collaboration_provisioning:11.5.0:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2017-6622 |
2025-11-11 15:19:30 | 2025-11-11 07:34:50 |
| NVD | nvd_CVE-2017-6622 |
2025-11-11 14:55:28 | 2025-11-11 07:43:28 |
| CNNVD | cnnvd_CNNVD-201705-848 |
2025-11-11 15:09:49 | 2025-11-11 07:53:03 |
| EXPLOITDB | exploitdb_EDB-42888 |
2025-11-11 15:05:22 | 2025-11-11 08:45:02 |
版本与语言
安全公告
变更历史
查看详细变更
- references_count: 4 -> 7
- tags_count: 0 -> 3
- data_sources: ['cnnvd', 'cve', 'nvd'] -> ['cnnvd', 'cve', 'exploitdb', 'nvd']
查看详细变更
- vulnerability_type: 未提取 -> 权限许可和访问控制问题
- cnnvd_id: 未提取 -> CNNVD-201705-848
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- severity: SeverityLevel.MEDIUM -> SeverityLevel.CRITICAL
- cvss_score: 未提取 -> 9.8
- cvss_vector: NOT_EXTRACTED -> CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- cvss_version: NOT_EXTRACTED -> 3.0
- affected_products_count: 0 -> 10
- data_sources: ['cve'] -> ['cve', 'nvd']