Skip to content
Fencer Vulns
medium 6.5

CVE-2017-6635 json

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 12.1) could allow an authenticate…

published 2017-05-22 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-15689

cvss
6.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
9.7%
EPSS 9.7% chance of exploitation in 30 days, percentile 95%
public exploits
0
none known

Summary

A vulnerability in the web interface of Cisco Prime Collaboration Provisioning Software (prior to Release 12.1) could allow an authenticated, remote attacker to delete any file from an affected system. The vulnerability exists because the affected software does not perform proper input validation of HTTP requests and fails to apply role-based access controls (RBACs) to requested HTTP URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request that uses directory traversal techniques to submit a path to a desired file location on an affected system. A successful exploit could allow the attacker to delete any file from the system. Cisco Bug IDs: CSCvc99597.

Exploit prediction

9.73% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 6.8 AV:N/AC:L/Au:S/C:N/I:C/A:N

Affected products

  • n/a Cisco Prime Collaboration Provisioning

Classification

Weakness
  • CWE-264 Permissions, Privileges, and Access Controls
  • CWE-862 Missing Authorization

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.