CVE-2017-3884

MEDIUM

Cisco Prime Infrastructure & EPN Manager <3.2 - Info Disclosure

Title source: llm

Description

A vulnerability in the web interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to access sensitive data. The attacker does not need administrator credentials and could use this information to conduct additional reconnaissance attacks. More Information: CSCvc60031 (Fixed) CSCvc60041 (Fixed) CSCvc60095 (Open) CSCvc60102 (Open). Known Affected Releases: 2.2 2.2(3) 3.0 3.1(0.0) 3.1(0.128) 3.1(4.0) 3.1(5.0) 3.2(0.0) 2.0(4.0.45D).

References (3)

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/97470

[Vendor Advisory] https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-cpi

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1038189

Scores

CVSS v3 6.5

EPSS 0.0023

EPSS Percentile 45.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Classification

CWE

CWE-200

Status published

Affected Products (10)

cisco/evolved_programmable_network_manager

cisco/prime_infrastructure

n/a/Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager < Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager

Timeline

Published Apr 07, 2017

Tracked Since Feb 18, 2026