PT-2019-4242 · Cisco · Cisco Dna Spaces: Connector+1

Published 2019-11-20 · Updated 2019-12-09 · CVE-2019-15995

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco DNA Center versions (affected versions not specified) Cisco DNA Spaces: Connector versions (affected versions not specified)

Description The issue is related to the lack of protection against SQL query structure attacks in the web interface of the system. This could allow a remote attacker to execute arbitrary code or SQL queries. The vulnerability exists due to improper validation of user-supplied input. An attacker could exploit this by entering malicious SQL statements in an affected field, potentially allowing them to remove the SQL database.

Recommendations For Cisco DNA Center, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Cisco DNA Spaces: Connector, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2019-04843

CVE-2019-15995

Affected Products

Cisco Dna Center

Cisco Dna Spaces: Connector

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-15995 · Security Note
• https://osv.dev/vulnerability/CVE-2019-15995 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-04843 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-dna-sqlinjection · Vendor Advisory