CVE-2017-12276
published 2017-11-02CVE-2017-12276: A vulnerability in the web framework code for the SQL database interface of the Cisco Prime Collaboration Provisioning application could allow an…
PriorityP350high8.1CVSS 3.0
AVNACLPRLUINSUCHIHAN
EPSS
1.42%
69.8th percentile
A vulnerability in the web framework code for the SQL database interface of the Cisco Prime Collaboration Provisioning application could allow an authenticated, remote attacker to impact the confidentiality and integrity of the application by executing arbitrary SQL queries, aka SQL Injection. The attacker could read or write information from the SQL database. The vulnerability is due to a lack of proper validation on user-supplied input within SQL queries. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious SQL statements to the affected application. An exploit could allow the attacker to determine the presence of certain values and write malicious input in the SQL database. The attacker would need to have valid user credentials. This vulnerability affects Cisco Prime Collaboration Provisioning Software Releases prior to 12.3. Cisco Bug IDs: CSCvf47935.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | prime_collaboration_provisioning | < 12.3 | 12.3 |
| cisco | prime_collaboration_provisioning_authenticated | — | — |
CVSS provenance
nvdv3.08.1HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N
vendor_cisco8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-h3qw-836p-7rfx: A vulnerability in the web framework code for the SQL database interface of the Cisco Prime Collaboration Provisioning application could allow an auth
ghsa_unreviewed·2022-05-13
CVE-2017-12276 [HIGH] CWE-20 GHSA-h3qw-836p-7rfx: A vulnerability in the web framework code for the SQL database interface of the Cisco Prime Collaboration Provisioning application could allow an auth
A vulnerability in the web framework code for the SQL database interface of the Cisco Prime Collaboration Provisioning application could allow an authenticated, remote attacker to impact the confidentiality and integrity of the application by executing arbitrary SQL queries, aka SQL Injection. The attacker could read or write information from the SQL database. The vulnerability is due to a lack of proper validation on user-supplied input within SQL queries. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious SQL statements to the affected application. An exploit could allow the attacker to determine the presence of certain values and write malicious input in the SQL database. The attacker would need to have valid user credentials. This vulnerability
Cisco
Cisco Prime Collaboration Provisioning Authenticated SQL Injection Vulnerability
vendor_cisco·2017-11-01·CVSS 8.1
CVE-2017-12276 [HIGH] CWE-20 Cisco Prime Collaboration Provisioning Authenticated SQL Injection Vulnerability
Cisco Prime Collaboration Provisioning Authenticated SQL Injection Vulnerability
A vulnerability in the web framework code for the SQL database interface of the Cisco Prime Collaboration Provisioning application could allow an authenticated, remote attacker to impact the confidentiality and integrity of the application by executing arbitrary SQL queries. The attacker could read or write information from the SQL database.
The vulnerability is due to a lack of proper validation on user-supplied input within SQL queries. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious SQL statements to the affected application. An exploit could allow the attacker to determine the presence of certain values and write malicious input in the SQL database. The attacke
Cisco
Cisco Prime Collaboration Provisioning Authenticated SQL Injection Vulnerability
vendor_cisco·CVSS 3.0
CVE-2017-12276 Cisco Prime Collaboration Provisioning Authenticated SQL Injection Vulnerability
CVE-2017-12276: Cisco Prime Collaboration Provisioning Authenticated SQL Injection Vulnerability
A vulnerability in the web framework code for the SQL database interface of the Cisco Prime Collaboration Provisioning application could allow an authenticated, remote attacker to impact the confidentiality and integrity of the application by executing arbitrary SQL queries. The attacker could read or write information from the SQL database. The vulnerability is due to a lack of proper validation on user-supplied input within SQL queries. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious SQL statements to the affected application. An exploit could allow the attacker to determine the presence of certain values and write malicious input in the SQL databas
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/101640http://www.securitytracker.com/id/1039711https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-cpcphttp://www.securityfocus.com/bid/101640http://www.securitytracker.com/id/1039711https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-cpcp
2017-11-02
Published