CVE-2019-1824
Description
A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute arbitrary SQL queries. This vulnerability exist because the software improperly validates user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains malicious SQL statements to the affected application. A successful exploit could allow the attacker to view or modify entries in some database tables, affecting the integrity of the data.
How to fix
- cisco evolved_programmable_network_manager3.0.1 or later
- cisco prime_infrastructure3.4.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco evolved_programmable_network_manager | v < 3.0.1 | 3.0.1 |
| cisco prime_infrastructure | v < 3.4.1 | 3.4.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.