CVE-2018-0320

CWE-89 — SQL Injection4 documents4 sources

Severity

9.8CRITICAL

EPSS

1.9%

top 16.65%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Prime Collaboration Cisco Prime Collaboration Provisioning

Timeline

PublishedJun 7

Latest updateMay 13

Description

A vulnerability in the web framework code of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The vulnerability is due to a lack of proper validation on user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious SQL statements to the affected application. This vulnerability affects Cisco Prime Collaboration Provisioning (PCP) Releases 12.1 and prior. …

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages3 packages

▶NVDcisco/prime_collaboration_provisioning12.1

▶CVEListV5cisco_prime_collaboration_provisioning_unknownCisco Prime Collaboration Provisioning unknown

▶NVDcisco/prime_collaboration12.1

🔴Vulnerability Details

GHSA

GHSA-76v7-r5m3-qxwx: A vulnerability in the web framework code of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to execute a↗2022-05-13

▶

CVEList

CVE-2018-0320: A vulnerability in the web framework code of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to execute a↗2018-06-07

▶

📋Vendor Advisories

Cisco

Cisco Prime Collaboration Provisioning SQL Injection Vulnerability↗2018-06-06

▶