{"schemaVersion":3,"id":"CVE-2017-6622","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass authentication and perform command injection with root privileges. The vulnerability is due to missing security constraints in certain HTTP request methods, which could allow access to files via the web interface. An attacker could exploit this vulnerability by sending a crafted HTTP request to the targeted application. This vulnerability affects Cisco Prime Collaboration Provisioning Software Releases prior to 12.1. Cisco Bug IDs: CSCvc98724.","dates":{"published":"2017-05-18T19:00:00.000Z","modified":"2024-08-05T15:33:20.447Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":10,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":9.8,"severity":"critical","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":10,"severity":"high","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.6217,"percentile":0.99176,"severity":"critical","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.6217},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.51422,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.6217,"percentile":0.99176}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.51422,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.6217,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.6217,"percentile":0.99176}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"42888","name":"Cisco Prime Collaboration Provisioning < 12.1 - Authentication Bypass / Remote Code Execution","source":"exploit-database","url":"https://www.exploit-db.com/exploits/42888","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"remote","platforms":["hardware"],"requiresAuth":null,"exploitdb":{"verified":false,"type":"remote","platform":"hardware","file":"exploits/hardware/remote/42888.sh","codes":["CVE-2017-6622"]},"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-264","name":"Permissions, Privileges, and Access Controls","description":"Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.","type":"category","status":"Obsolete","abstraction":null,"likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/264.html"},{"id":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/862.html"}],"affected":[{"vendor":"cisco","product":"prime_collaboration_provisioning","name":"prime collaboration provisioning","label":"prime_collaboration_provisioning","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"9.0.0","noFixRecorded":false,"fixedIn":null},{"text":"9.5.0","noFixRecorded":false,"fixedIn":null},{"text":"10.0.0","noFixRecorded":false,"fixedIn":null},{"text":"10.5.0","noFixRecorded":false,"fixedIn":null},{"text":"10.5.1","noFixRecorded":false,"fixedIn":null},{"text":"10.6.0","noFixRecorded":false,"fixedIn":null},{"text":"10.6.2","noFixRecorded":false,"fixedIn":null},{"text":"11.0.0","noFixRecorded":false,"fixedIn":null},{"text":"11.1.0","noFixRecorded":false,"fixedIn":null},{"text":"11.5.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"9.0.0 | 9.5.0 | 10.0.0 | 10.5.0 | 10.5.1 | 10.6.0 | 10.6.2 | 11.0.0 | 11.1.0 | 11.5.0","eol":null,"hubHref":"/vendor/cisco/prime_collaboration_provisioning"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securitytracker.com/id/1038507","label":"www.securitytracker.com/id/1038507","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"http://www.securityfocus.com/bid/98520","label":"www.securityfocus.com/bid/98520","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"https://www.exploit-db.com/exploits/42888/","label":"www.exploit-db.com/exploits/42888/","hostname":"www.exploit-db.com","tags":["Exploit","X Refsource EXPLOIT DB"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-pcp1","label":"tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170517-pcp1","hostname":"tools.cisco.com","tags":["X Refsource CONFIRM","Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2017-05-18T19:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-05T15:33:20.447Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T18:02:14.716Z","stale":false,"partial":false}}