PT-2020-2876 · Cisco · Cisco Prime Infrastructure
Published
2020-06-03
·
Updated
2020-06-05
·
CVE-2020-3339
CVSS v2.0
6.4
Medium
| Vector | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Name of the Vulnerable Software and Affected Versions
Cisco Prime Infrastructure (affected versions not specified)
Description
The issue is related to a vulnerability in the web-based management interface, allowing an authenticated, remote attacker to conduct SQL injection attacks. This is due to improper validation of user-submitted parameters, such as
username and password. An attacker could exploit this by sending malicious requests to the system, potentially obtaining and modifying sensitive information stored in the underlying database. The vulnerability is also described as related to the lack of protection against SQL query structure attacks, which could allow a remote attacker to execute arbitrary SQL queries.Recommendations
For Cisco Prime Infrastructure, consider restricting access to the web-based management interface until a fix is available.
As a temporary workaround, avoid using user-submitted parameters in the affected system to minimize the risk of exploitation.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cisco Prime Infrastructure