SQL Injection Vulnerability in Cisco Prime Collaboration Provisioning
CVE-2018-0320

9.8CRITICAL

Key Information:

Vendor

Cisco
Status
Cisco Prime Collaboration Provisioning Unknown
Vendor
CVE Published:
7 June 2018

What is CVE-2018-0320?

A vulnerability in Cisco Prime Collaboration Provisioning (PCP) can potentially allow an unauthenticated remote attacker to execute arbitrary SQL queries. This issue arises from inadequate validation of user-supplied input within SQL queries. Attackers could exploit the vulnerability by sending specially crafted URLs that include malicious SQL commands, impacting the integrity of the application. The vulnerability affects PCP Releases 12.1 and earlier.

Affected Version(s)

Cisco Prime Collaboration Provisioning unknown Cisco Prime Collaboration Provisioning unknown

References

https://tools.cisco.com/security/center/content/CiscoSecu...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/104416
vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1041084
vdb-entryx_refsource_SECTRACK

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.