PT-2020-3130 · Cisco · Cisco Vision Dynamic Signage Director

Published 2020-07-15 · Updated 2020-07-22 · CVE-2020-3450

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Vision Dynamic Signage Director (affected versions not specified)

Description A vulnerability in the web-based management interface could allow an authenticated, remote attacker with administrative credentials to conduct SQL injection attacks. The issue is due to improper validation of user-submitted parameters, specifically in the SQL query structure. An attacker could exploit this by authenticating to the interface and sending malicious requests, potentially obtaining data stored in the underlying database, including hashed user credentials. The attacker would need valid administrative credentials to exploit this issue.

Recommendations To resolve the issue, update the system to a version that includes proper validation of user-submitted parameters. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2020-03422

CVE-2020-3450

Affected Products

Cisco Vision Dynamic Signage Director

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-visio-dir-sql-inj-fPm3MPfT · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03422 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3450 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3450 · Security Note