PT-2023-3354 · Cisco · Cisco Smart Software Manager On-Prem
Jakub Brzozowski
+1
·
Publicado
2023-05-17
·
Atualizado
2023-07-16
·
CVE-2023-20110
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:L/Au:S/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Cisco Smart Software Manager On-Prem (affected versions not specified)
Description
A vulnerability in the web-based management interface of Cisco Smart Software Manager On-Prem could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This issue exists because the web-based management interface inadequately validates user input. An attacker could exploit this vulnerability by authenticating to the application as a low-privileged user and sending crafted SQL queries to an affected system. A successful exploit could allow the attacker to read sensitive data on the underlying database.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Special Elements Injection
Improper Neutralization
SQL injection
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Cisco Smart Software Manager On-Prem