Vulnerability Description
A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute arbitrary SQL queries. This vulnerability exist because the software improperly validates user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains malicious SQL statements to the affected application. A successful exploit could allow the attacker to view or modify entries in some database tables, affecting the integrity of the data.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Evolved Programmable Network Manager | < 3.0.1 |
| Cisco | Network Level Service | 3.0\(0.0.83b\) |
| Cisco | Prime Infrastructure | < 3.4.1 |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/108337Third Party AdvisoryVDB Entry
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2Vendor Advisory
- http://www.securityfocus.com/bid/108337Third Party AdvisoryVDB Entry
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2Vendor Advisory
FAQ
What is CVE-2019-1825?
CVE-2019-1825 is a vulnerability with a CVSS score of 8.1 (HIGH). A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute a...
How severe is CVE-2019-1825?
CVE-2019-1825 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-1825?
Check the references section above for vendor advisories and patch information. Affected products include: Cisco Evolved Programmable Network Manager, Cisco Network Level Service, Cisco Prime Infrastructure.