CVE-2021-1248 — SQL Injection in Cisco Data Center Network Manager

CWE-89 — SQL Injection4 documents4 sources
Severity
7.2HIGHNVD
CNA8.8
EPSS
0.7%
top 27.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Data Center Network ManagerCisco Data Center Network Manager
Timeline
PublishedJan 20
Latest updateMay 24

Description

Multiple vulnerabilities in certain REST API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to execute arbitrary SQL commands on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-pcp9-3jpm-8q4g: Multiple vulnerabilities in certain REST API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker to ex↗2022-05-24
▶
CVEList
Cisco Data Center Network Manager SQL Injection Vulnerabilities↗2021-01-20
▶

📋Vendor Advisories

1
Cisco
Cisco Data Center Network Manager SQL Injection Vulnerabilities↗2021-01-20
▶
CVE-2021-1248 — SQL Injection in Cisco | cvebase