CVE-2017-12276

CWE-20 — Improper Input ValidationCWE-89 — SQL Injection4 documents4 sources
Severity
8.1HIGH
EPSS
0.2%
top 56.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Prime Collaboration Provisioning
Timeline
PublishedNov 2
Latest updateMay 13

Description

A vulnerability in the web framework code for the SQL database interface of the Cisco Prime Collaboration Provisioning application could allow an authenticated, remote attacker to impact the confidentiality and integrity of the application by executing arbitrary SQL queries, aka SQL Injection. The attacker could read or write information from the SQL database. The vulnerability is due to a lack of proper validation on user-supplied input within SQL queries. An attacker could exploit this vulnera…

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:NExploitability: 2.8 | Impact: 5.2

Affected Packages2 packages

▶CVEListV5cisco_prime_collaboration_provisioningCisco Prime Collaboration Provisioning

🔴Vulnerability Details

2
GHSA
GHSA-h3qw-836p-7rfx: A vulnerability in the web framework code for the SQL database interface of the Cisco Prime Collaboration Provisioning application could allow an auth↗2022-05-13
▶
CVEList
CVE-2017-12276: A vulnerability in the web framework code for the SQL database interface of the Cisco Prime Collaboration Provisioning application could allow an auth↗2017-11-02
▶

📋Vendor Advisories

1
Cisco
Cisco Prime Collaboration Provisioning Authenticated SQL Injection Vulnerability↗2017-11-01
▶