PT-2020-1364 · Cisco · Cisco Data Center Network Manager

Published 2020-01-02 · Updated 2023-02-02 · CVE-2019-15984

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Data Center Network Manager (affected versions not specified)

Description The issue is related to multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager, which could allow an authenticated, remote attacker to execute arbitrary SQL commands on an affected device. To exploit these vulnerabilities, an attacker would need administrative privileges on the DCNM application. The vulnerabilities are associated with errors in input data validation, potentially allowing an attacker to gain unauthorized access to protected information, impact data integrity, or execute arbitrary commands in the underlying operating system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2020-00312

CVE-2019-15984

ZDI-20-016

ZDI-20-017

ZDI-20-018

ZDI-20-019

ZDI-20-020

ZDI-20-021

ZDI-20-022

ZDI-20-023

ZDI-20-024

ZDI-20-025

ZDI-20-026

ZDI-20-027

ZDI-20-028

ZDI-20-029

ZDI-20-030

ZDI-20-031

ZDI-20-032

ZDI-20-033

ZDI-20-034

ZDI-20-035

ZDI-20-036

ZDI-20-037

ZDI-20-038

ZDI-20-039

ZDI-20-040

ZDI-20-041

ZDI-20-042

ZDI-20-043

ZDI-20-044

ZDI-20-045

ZDI-20-046

ZDI-20-047

ZDI-20-048

ZDI-20-049

ZDI-20-050

ZDI-20-051

ZDI-20-052

ZDI-20-053

ZDI-20-054

ZDI-20-055

ZDI-20-056

ZDI-20-057

ZDI-20-058

ZDI-20-059

ZDI-20-060

ZDI-20-063

ZDI-20-064

ZDI-20-065

ZDI-20-066

ZDI-20-067

ZDI-20-068

ZDI-20-069

ZDI-20-070

ZDI-20-071

ZDI-20-072

ZDI-20-073

ZDI-20-074

ZDI-20-075

ZDI-20-076

ZDI-20-077

ZDI-20-078

ZDI-20-079

ZDI-20-080

ZDI-20-081

ZDI-20-082

ZDI-20-083

ZDI-20-084

ZDI-20-085

ZDI-20-086

ZDI-20-087

ZDI-20-088

ZDI-20-089

ZDI-20-090

ZDI-20-091

ZDI-20-092

ZDI-20-093

ZDI-20-094

ZDI-20-095

ZDI-20-096

ZDI-20-097

ZDI-20-098

ZDI-20-099

ZDI-20-104

ZDI-20-105

ZDI-20-106

ZDI-20-107

ZDI-20-108

ZDI-20-109

ZDI-20-110

ZDI-20-111

ZDI-20-112

ZDI-20-113

ZDI-20-115

ZDI-20-116

ZDI-20-121

Affected Products

Cisco Data Center Network Manager

References · 101

• 🔥 https://exploit-db.com/exploits/48019 · Exploit
• 🔥 http://packetstormsecurity.com/files/156239/Cisco-Data-Center-Network-Manager-11.2.1-SQL-Injection.html · Exploit
• https://zerodayinitiative.com/advisories/ZDI-20-082 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-057 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-081 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-074 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-092 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-019 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-073 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-077 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-111 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-060 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-093 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-121 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-094 · Security Note