{"schemaVersion":3,"id":"CVE-2017-6704","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"A vulnerability in the web application in the Cisco Prime Collaboration Provisioning tool could allow an authenticated, remote attacker to perform arbitrary file downloads that could allow the attacker to read files from the underlying filesystem. More Information: CSCvc90335. Known Affected Releases: 12.1.","dates":{"published":"2017-07-04T00:00:00.000Z","modified":"2024-08-05T15:41:16.684Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.5,"severity":"medium","version":"3.0","versionLabel":"v3.0","source":"NVD","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.0","versionLabel":"v3.0","source":"NVD","score":6.5,"severity":"medium","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4,"severity":"medium","vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.02992,"percentile":0.87124,"severity":"low","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.02992},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02005,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02992,"percentile":0.87124}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02005,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02992,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02992,"percentile":0.87124}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')","description":"The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/22.html"}],"affected":[{"vendor":"cisco","product":"prime_collaboration_provisioning","name":"prime collaboration provisioning","label":"prime_collaboration_provisioning","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"12.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"12.1","eol":null,"hubHref":"/vendor/cisco/prime_collaboration_provisioning"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://www.securitytracker.com/id/1038744","label":"www.securitytracker.com/id/1038744","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Third Party Advisory"]},{"url":"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-pcp2","label":"tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-pcp2","hostname":"tools.cisco.com","tags":["X Refsource CONFIRM","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/99223","label":"www.securityfocus.com/bid/99223","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2017-07-04T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-05T15:41:16.684Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":27,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T13:13:10.671Z","stale":false,"partial":false}}