PT-2024-1510 · Cisco · Cisco Prime Infrastructure+1
Jérôme Nokin
·
Published
2024-01-10
·
Updated
2024-02-02
·
CVE-2023-20271
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:L/Au:S/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Cisco Prime Infrastructure (affected versions not specified)
Cisco Evolved Programmable Network Manager (EPNM) (affected versions not specified)
Description
A vulnerability in the web-based management interface could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This is due to improper validation of user-submitted parameters. An attacker could exploit this by authenticating to the application and sending malicious requests to an affected system. A successful exploit could allow the attacker to obtain and modify sensitive information stored in the underlying database.
Recommendations
For Cisco Prime Infrastructure, update to a version that includes the fix for this issue.
For Cisco Evolved Programmable Network Manager (EPNM), update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to the web-based management interface to minimize the risk of exploitation.
Avoid using user-submitted parameters in the affected interface until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Cisco Evolved Programmable Network Manager
Cisco Prime Infrastructure