CVE-2021-1222

published 2021-01-20

CVE-2021-1222: A vulnerability in the web-based management interface of Cisco Smart Software Manager Satellite could allow an authenticated, remote attacker to conduct SQL…

high 8.1 CVSS 3.1

AV N AC L PR L UI N S U C H I H A N

A vulnerability in the web-based management interface of Cisco Smart Software Manager Satellite could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management interface improperly validates values within SQL queries. An attacker could exploit this vulnerability by authenticating to the application and sending malicious SQL queries to an affected system. A successful exploit could allow the attacker to modify values on or return values from the underlying database or the operating system.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
cisco	cisco_smart_software_manager_on-prem	—	—
cisco	smart	—	—
cisco	smart_software_manager_on-prem	<= 5.1.0	—

CWE-89