CVE-2013-5525 — SQL Injection in Cisco Identity Services Engine Software

CWE-89 — SQL Injection4 documents4 sources

Severity

6.5MEDIUMNVD

EPSS

0.8%

top 26.63%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Identity Services Engine Software

Timeline

PublishedOct 10

Latest updateMay 17

Description

SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCug90502.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 8.0 | Impact: 6.4

Affected Packages1 packages

▶NVDcisco/identity_services_engine_software1.2+2

🔴Vulnerability Details

GHSA

GHSA-67q2-r7xw-j63p: SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1↗2022-05-17

▶

CVEList

CVE-2013-5525: SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1↗2013-10-10

▶

📋Vendor Advisories

Cisco

Cisco Identity Services Engine Blind SQL Injection Vulnerability↗2013-10-09

▶