Lucene search

CiscoCVE-2019-1825

HistoryMay 16, 2019 - 1:29 a.m.

CVE-2019-1825

2019-05-1601:29:00

CWE-89

cisco

web.nvd.nist.gov

cisco

prime infrastructure

epn manager

vulnerability

sql injection

remote attacker

nvd

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

8.3

Confidence

High

EPSS

0.001

Percentile

49.6%

JSON

A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute arbitrary SQL queries. This vulnerability exist because the software improperly validates user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains malicious SQL statements to the affected application. A successful exploit could allow the attacker to view or modify entries in some database tables, affecting the integrity of the data.

Affected configurations

Nvd

Node

ciscoevolved_programmable_network_managerRange<3.0.1

cisconetwork_level_serviceMatch3.0\(0.0.83b\)

ciscoprime_infrastructureRange<3.4.1

VendorProductVersionCPE
ciscoevolved_programmable_network_manager*cpe:2.3:a:cisco:evolved_programmable_network_manager:*:*:*:*:*:*:*:*
cisconetwork_level_service3.0(0.0.83b)cpe:2.3:a:cisco:network_level_service:3.0\(0.0.83b\):*:*:*:*:*:*:*
ciscoprime_infrastructure*cpe:2.3:a:cisco:prime_infrastructure:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	evolved_programmable_network_manager	*	cpe:2.3:a:cisco:evolved_programmable_network_manager::::::::
cisco	network_level_service	3.0(0.0.83b)	cpe:2.3:a:cisco:network_level_service:3.0\(0.0.83b\):::::::*
cisco	prime_infrastructure	*	cpe:2.3:a:cisco:prime_infrastructure::::::::

CNA Affected

[
  {
    "product": "Cisco Prime Infrastructure",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "3.4"
      }
    ]
  }
]

References

www.securityfocus.com/bid/108337

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-sqlinject

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

8.3

Confidence

High

EPSS

0.001

Percentile

49.6%

JSON

Related for CVE-2019-1825