PT-2017-17252 · Cisco · Cisco Evolved Programmable Network Manager+1

Publicado 2017-07-04 · Atualizado 2017-07-07 · CVE-2017-6698

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) versions 2.0(4.0.45B) through 3.1(1)

Description A SQL Injection issue in the SQL database interface could allow an authenticated, remote attacker to impact the confidentiality and integrity of the application by executing arbitrary SQL queries.

Recommendations For versions 2.0(4.0.45B) through 3.1(1), consider restricting access to the SQL database interface until a patch is available. As a temporary workaround, avoid using the SQL database interface for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-6698

Produtos afetados

Cisco Prime Infrastructure

Cisco Evolved Programmable Network Manager

Referências · 5

• http://securitytracker.com/id/1038751 · Nota
• https://osv.dev/vulnerability/CVE-2017-6698 · Aviso do Fabricante
• http://securityfocus.com/bid/99214 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-piepnm2 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6698 · Nota de Segurança