CVE-2024-20472

CWE-89 — SQL Injection4 documents4 sources
Severity
6.5MEDIUM
EPSS
0.3%
top 44.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Cisco Firepower Management CenterCisco Secure Firewall Management Center
Timeline
PublishedOct 23

Description

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface does not validate user input adequately. An attacker could exploit this vulnerability by authenticating to the application as an Administrator and sending crafted SQL queries to an affected system. A successful explo…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NExploitability: 1.2 | Impact: 5.2

Affected Packages2 packages

🔴Vulnerability Details

2
CVEList
CVE-2024-20472: A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote a↗2024-10-23
▶
GHSA
GHSA-253g-rphr-6h5j: A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote a↗2024-10-23
▶

📋Vendor Advisories

1
Cisco
Cisco Secure Firewall Management Center Software SQL Injection Vulnerabilities↗2024-10-23
▶