PT-2017-17252 · Cisco · Cisco Evolved Programmable Network Manager+1

Published 2017-07-04 · Updated 2017-07-07 · CVE-2017-6698

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) versions 2.0(4.0.45B) through 3.1(1)

Description A SQL Injection issue in the SQL database interface could allow an authenticated, remote attacker to impact the confidentiality and integrity of the application by executing arbitrary SQL queries.

Recommendations For versions 2.0(4.0.45B) through 3.1(1), consider restricting access to the SQL database interface until a patch is available. As a temporary workaround, avoid using the SQL database interface for sensitive operations until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2017-6698

Affected Products

Cisco Prime Infrastructure

Cisco Evolved Programmable Network Manager

References · 5

• https://osv.dev/vulnerability/CVE-2017-6698 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-piepnm2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6698 · Security Note
• http://securitytracker.com/id/1038751 · Note
• http://securityfocus.com/bid/99214 · Note