CVE-2024-20473

CWE-89 — SQL Injection4 documents4 sources
Severity
6.5MEDIUM
EPSS
0.3%
top 43.85%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Cisco Cisco Firepower Management CenterCisco Secure Firewall Management Center
Timeline
PublishedOct 23

Description

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface does not validate user input adequately. An attacker could exploit this vulnerability by authenticating to the application as an Administrator and sending crafted SQL queries to an affected system. A successful explo…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NExploitability: 1.2 | Impact: 5.2

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-hvrr-v8q8-3r9q: A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote a↗2024-10-23
▶
CVEList
CVE-2024-20473: A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote a↗2024-10-23
▶

📋Vendor Advisories

1
Cisco
Cisco Secure Firewall Management Center Software SQL Injection Vulnerabilities↗2024-10-23
▶
CVE-2024-20473 (MEDIUM CVSS 6.5) | A vulnerability in the web-based ma | cvebase.io