CVE-2017-6698
published 2017-07-04CVE-2017-6698: A vulnerability in the Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) SQL database interface could allow an authenticated…
PriorityP337medium5.4CVSS 3.0
AVNACLPRLUINSUCLILAN
EPSS
0.94%
56.8th percentile
A vulnerability in the Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) SQL database interface could allow an authenticated, remote attacker to impact the confidentiality and integrity of the application by executing arbitrary SQL queries, aka SQL Injection. More Information: CSCvc23892 CSCvc35270 CSCvc35626 CSCvc35630 CSCvc49568. Known Affected Releases: 3.1(1) 2.0(4.0.45B).
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | prime_infrastructure | — | — |
| cisco | prime_infrastructure | — | — |
| cisco | prime_infrastructure_and_evolved_programmable_network_manager | — | — |
CVSS provenance
nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N
vendor_cisco6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerability
vendor_cisco·2017-06-21·CVSS 6.5
CVE-2017-6698 [MEDIUM] CWE-89 Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerability
Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerability
A vulnerability in the Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) SQL database interface could allow an authenticated, remote attacker to impact the confidentiality and integrity of the application by executing arbitrary SQL queries.
The vulnerability is due to a lack of proper validation on user-supplied input within SQL queries. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious SQL statements to the affected application. An exploit could allow the attacker to determine the presence of certain values and write malicious input to the SQL database.
For additional information about SQL injection attacks, see https://
Cisco
Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerability
vendor_cisco·CVSS 3.0
CVE-2017-6698 Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerability
CVE-2017-6698: Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerability
A vulnerability in the Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) SQL database interface could allow an authenticated, remote attacker to impact the confidentiality and integrity of the application by executing arbitrary SQL queries. The vulnerability is due to a lack of proper validation on user-supplied input within SQL queries. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious SQL statements to the affected application. An exploit could allow the attacker to determine the presence of certain values and write malicious input to the SQL database. For additional information about SQL injection attacks,
GHSA
GHSA-ggjg-37r9-4hhp: A vulnerability in the Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) SQL database interface could allow an authentic
ghsa_unreviewed·2022-05-17
CVE-2017-6698 [MEDIUM] CWE-89 GHSA-ggjg-37r9-4hhp: A vulnerability in the Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) SQL database interface could allow an authentic
A vulnerability in the Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) SQL database interface could allow an authenticated, remote attacker to impact the confidentiality and integrity of the application by executing arbitrary SQL queries, aka SQL Injection. More Information: CSCvc23892 CSCvc35270 CSCvc35626 CSCvc35630 CSCvc49568. Known Affected Releases: 3.1(1) 2.0(4.0.45B).
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/99214http://www.securitytracker.com/id/1038751https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-piepnm2http://www.securityfocus.com/bid/99214http://www.securitytracker.com/id/1038751https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-piepnm2
2017-07-04
Published