This vulnerability in Cisco Prime Infrastructure arises from missing authorization checks on the download service API used for log file retrieval. An attacker with valid credentials can exploit this by crafting URL requests to download arbitrary log files from the server, potentially accessing sensitive information. The issue affects a wide range of versions from 3.2.0-FIPS through 3.10.6 Update 02. The CVSS 3.1 base score is 4.3 (medium), reflecting network attack vector, low complexity, required privileges, no user interaction, and limited confidentiality impact. No vendor advisory or patch information is currently available to confirm remediation status.

An attacker with valid credentials to the Cisco Prime Infrastructure web interface could download log files they are not authorized to access, potentially exposing sensitive information contained in those logs. There is no impact on system integrity or availability reported. The vulnerability does not allow privilege escalation or remote code execution but could aid further reconnaissance or information gathering by an attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Cisco Prime Infrastructure management interface to trusted users only and monitor for unauthorized access attempts. Review user privileges to ensure minimal necessary access is granted. Avoid exposing the management interface to untrusted networks.