PT-2019-4242 · Cisco · Cisco Dna Spaces: Connector+1

Publicado 2019-11-20 · Atualizado 2019-12-09 · CVE-2019-15995

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco DNA Center versions (affected versions not specified) Cisco DNA Spaces: Connector versions (affected versions not specified)

Description The issue is related to the lack of protection against SQL query structure attacks in the web interface of the system. This could allow a remote attacker to execute arbitrary code or SQL queries. The vulnerability exists due to improper validation of user-supplied input. An attacker could exploit this by entering malicious SQL statements in an affected field, potentially allowing them to remove the SQL database.

Recommendations For Cisco DNA Center, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Cisco DNA Spaces: Connector, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BDU:2019-04843

CVE-2019-15995

Produtos afetados

Cisco Dna Center

Cisco Dna Spaces: Connector

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-15995 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-15995 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2019-04843 · Nota de Segurança
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-dna-sqlinjection · Aviso do Fabricante