Directory listing in Cisco Prime Collaboration Assurance - CVE-2017-3844
Published: February 15, 2017 / Updated: February 17, 2017
Vulnerability identifier: #VU5856
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-3844
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to list and download system files.
The vulnerability exists due to improper input validation in Cisco Prime Collaboration Assurance when processing HTTP requests.A remote unauthenticated attacker can send a specially rcfated HTTP request and view list of files in directories.
Successful exploitation of the vulnerability may allow an attacker access potentially sensitive information.
Affected software
Cisco Prime Collaboration Assurance
How to mitigate CVE-2017-3844
Install update from vendor's website.