CVE-2017-12285

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

A vulnerability in the web interface of Cisco Network Analysis Module Software could allow an unauthenticated, remote attacker to delete arbitrary files from an affected system, aka Directory Traversal. The vulnerability exists because the affected software does not perform proper input validation of HTTP requests that it receives and the software does not apply role-based access controls (RBACs) to requested HTTP URLs. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected software. A successful exploit could allow the attacker to delete arbitrary files from the affected system. Cisco Bug IDs: CSCvf41365.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-20 CWE-22

Affected software

Vendor	Product	Versions
n/a	Cisco Network Analysis Module	Cisco Network Analysis Module

References

http://www.securityfocus.com/bid/101527Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039623Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-namVendor Advisory
http://www.securityfocus.com/bid/101527Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1039623Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-namVendor Advisory

Timeline

Published: Oct 19, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-122865.5A vulnerability in the web interface of Cisco Jabber could allow an authenticated, local attacker to retrieve user profile information from CVE-2017-122874.3A vulnerability in the cluster database (CDB) management component of Cisco Expressway Series Software and Cisco TelePresence Video Communic CVE-2017-122886.1A vulnerability in the web-based management interface of Cisco Unified Contact Center Express could allow an unauthenticated, remote attacke CVE-2017-122894.4A vulnerability in conditional, verbose debug logging for the IPsec feature of Cisco IOS XE Software could allow an authenticated, local att CVE-2017-12295.9IBM Tivoli Endpoint Manager (IBM BigFix 9.2 and 9.5) could allow a remote attacker to obtain sensitive information, caused by the failure to CVE-2017-122906.1Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service (a cloud-based service) could allow an unauthenticate CVE-2017-122916.1Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service (a cloud-based service) could allow an unauthenticate CVE-2017-122926.1Multiple vulnerabilities in the web interface of the Cisco Registered Envelope Service (a cloud-based service) could allow an unauthenticate CVE-2017-122938.6A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition.CVE-2017-122945.4A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack CVE-2017-122955.3A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to access sensitive data about the applicatio CVE-2017-122966.1A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attac