PT-2017-17293 · Cisco · Cisco Smart Net Total Care (Sntc) Software Collector Appliance

Publicado 2017-08-07 · Atualizado 2019-10-09 · CVE-2017-6754

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Smart Net Total Care (SNTC) Software Collector Appliance version 3.11

Description A vulnerability in the web-based management interface could allow an authenticated, remote attacker to perform a read-only, blind SQL injection attack. This could compromise the confidentiality of the system through SQL timing attacks due to insufficient input validation of certain user-supplied fields used to build SQL queries. An attacker could exploit this by submitting crafted URLs to the affected software, requiring multiple requests to execute an attack successfully. A successful exploit could allow the attacker to determine the presence of values in the SQL database.

Recommendations For Cisco Smart Net Total Care (SNTC) Software Collector Appliance version 3.11, consider restricting access to the web-based management interface until a fix is available. As a temporary workaround, avoid using user-supplied fields that are used to build SQL queries to minimize the risk of exploitation.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2017-6754

Produtos afetados

Cisco Smart Net Total Care (Sntc) Software Collector Appliance

Referências · 5

• http://securityfocus.com/bid/100126 · Nota
• https://osv.dev/vulnerability/CVE-2017-6754 · Aviso do Fabricante
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170802-sntc · Aviso do Fabricante
• https://quickview.cloudapps.cisco.com/quickview/bug/CSCvf07617 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-6754 · Nota de Segurança