CVE-2017-3844 Path traversal in Cisco Prime Collaboration Assurance
An authenticated remote attacker can view directory listings and download files via the export function in Cisco Prime Collaboration Assurance.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-3844?
CVE-2017-3844 is a medium-severity path traversal vulnerability in Cisco Prime Collaboration Assurance, published on 22 Feb 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability in exporting functions of the user interface for Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to view file directory listings and download files. Affected Products: Cisco Prime Collaboration Assurance software versions 11.0, 11.1, and 11.5 are vulnerable. Cisco Prime Collaboration Assurance software versions prior to 11.0 are not vulnerable. More Information: CSCvc86238. Known Affected Releases: 11.5(0).
Weakness: CWE-20
Which versions are affected by CVE-2017-3844?
It affects 1 product.
Products include Cisco Prime Collaboration Assurance.
How do I fix CVE-2017-3844?
No fix has been published for CVE-2017-3844 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2017-3844 being exploited?
There is no known exploitation of CVE-2017-3844 in the wild and no public exploit code.
Other vulnerabilities in Cisco Prime Collaboration Assurance
Sources
Also known as GHSA-hcf3-m8fc-xfmv.