Sign-up

ID

VAR-201905-0510


CVE

CVE-2019-1825


TITLE

Cisco Prime Infrastructure and Evolved Programmable Network Manager In SQL Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-004655

DESCRIPTION

A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute arbitrary SQL queries. This vulnerability exist because the software improperly validates user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains malicious SQL statements to the affected application. A successful exploit could allow the attacker to view or modify entries in some database tables, affecting the integrity of the data. This issue is tracked by Cisco Bug ID's CSCvo23576, CSCvo28734, CSCvo62268 and CSCvo62275. Attackers can exploit this vulnerability to execute illegal SQL commands

Trust: 2.07

sources: NVD: CVE-2019-1825 // JVNDB: JVNDB-2019-004655 // BID: 108337 // VULHUB: VHN-150577 // VULMON: CVE-2019-1825

AFFECTED PRODUCTS

vendor:ciscomodel:network level servicescope:eqversion:3.0\(0.0.83b\)

Trust: 1.0

vendor:ciscomodel:evolved programmable network managerscope:ltversion:3.0.1

Trust: 1.0

vendor:ciscomodel:prime infrastructurescope:ltversion:3.4.1

Trust: 1.0

vendor:ciscomodel:evolved programmable network managerscope: - version: -

Trust: 0.8

vendor:ciscomodel:prime infrastructurescope: - version: -

Trust: 0.8

vendor:ciscomodel:prime infrastructurescope:eqversion:3.4

Trust: 0.3

vendor:ciscomodel:evolved programmable network managerscope:eqversion:3.0

Trust: 0.3

vendor:ciscomodel:prime infrastructurescope:neversion:3.4.1

Trust: 0.3

vendor:ciscomodel:prime infrastructurescope:neversion:3.6

Trust: 0.3

vendor:ciscomodel:prime infrastructurescope:neversion:3.5

Trust: 0.3

vendor:ciscomodel:evolved programmable network managerscope:neversion:3.0.1

Trust: 0.3

sources: BID: 108337 // JVNDB: JVNDB-2019-004655 // NVD: CVE-2019-1825

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-1825
value: HIGH

Trust: 1.0

ykramarz@cisco.com: CVE-2019-1825
value: HIGH

Trust: 1.0

NVD: CVE-2019-1825
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201905-698
value: HIGH

Trust: 0.6

VULHUB: VHN-150577
value: MEDIUM

Trust: 0.1

VULMON: CVE-2019-1825
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2019-1825
severity: MEDIUM
baseScore: 5.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-150577
severity: MEDIUM
baseScore: 5.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-1825
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 5.2
version: 3.0

Trust: 2.8

sources: VULHUB: VHN-150577 // VULMON: CVE-2019-1825 // JVNDB: JVNDB-2019-004655 // CNNVD: CNNVD-201905-698 // NVD: CVE-2019-1825 // NVD: CVE-2019-1825

PROBLEMTYPE DATA

problemtype:CWE-89

Trust: 1.9

sources: VULHUB: VHN-150577 // JVNDB: JVNDB-2019-004655 // NVD: CVE-2019-1825

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201905-698

TYPE

SQL injection

Trust: 0.6

sources: CNNVD: CNNVD-201905-698

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-004655

PATCH
title:cisco-sa-20190515-pi-sqlinjecturl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-sqlinject
Trust: 0.8
title:Cisco Prime Infrastructure  and Cisco Evolved Programmable Network Manager Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=92822
Trust: 0.6
title:Cisco: Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-20190515-pi-sqlinject
Trust: 0.1
title:Threatposturl:https://threatpost.com/cisco-webex-remote-code-execution/144805/
Trust: 0.1
sources:
            
            
            VULMON: CVE-2019-1825 // 
            
            
            
            JVNDB: JVNDB-2019-004655 // 
            
            
            
            CNNVD: CNNVD-201905-698

EXTERNAL IDS
db:NVDid:CVE-2019-1825
Trust: 2.9
db:BIDid:108337
Trust: 2.1
db:JVNDBid:JVNDB-2019-004655
Trust: 0.8
db:CNNVDid:CNNVD-201905-698
Trust: 0.7
db:AUSCERTid:ESB-2019.1753
Trust: 0.6
db:VULHUBid:VHN-150577
Trust: 0.1
db:VULMONid:CVE-2019-1825
Trust: 0.1
sources:
            
            
            VULHUB: VHN-150577 // 
            
            
            
            VULMON: CVE-2019-1825 // 
            
            
            
            BID: 108337 // 
            
            
            
            JVNDB: JVNDB-2019-004655 // 
            
            
            
            CNNVD: CNNVD-201905-698 // 
            
            
            
            NVD: CVE-2019-1825

REFERENCES
url:http://www.securityfocus.com/bid/108337
Trust: 2.5
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-pi-sqlinject
Trust: 2.2
url:https://nvd.nist.gov/vuln/detail/cve-2019-1825
Trust: 1.4
url:http://www.cisco.com/
Trust: 0.9
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-1825
Trust: 0.8
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190515-pi-pathtrav-1819
Trust: 0.6
url:https://vigilance.fr/vulnerability/cisco-prime-infrastructure-sql-injection-via-web-ui-29318
Trust: 0.6
url:https://www.auscert.org.au/bulletins/81094
Trust: 0.6
url:https://cwe.mitre.org/data/definitions/89.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://threatpost.com/cisco-webex-remote-code-execution/144805/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-150577 // 
            
            
            
            VULMON: CVE-2019-1825 // 
            
            
            
            BID: 108337 // 
            
            
            
            JVNDB: JVNDB-2019-004655 // 
            
            
            
            CNNVD: CNNVD-201905-698 // 
            
            
            
            NVD: CVE-2019-1825

CREDITS
Steven Seeley (mr_me) of Source Incite.
Trust: 0.9
sources:
            
            
            BID: 108337 // 
            
            
            
            CNNVD: CNNVD-201905-698

SOURCES
db:VULHUBid:VHN-150577
db:VULMONid:CVE-2019-1825
db:BIDid:108337
db:JVNDBid:JVNDB-2019-004655
db:CNNVDid:CNNVD-201905-698
db:NVDid:CVE-2019-1825

LAST UPDATE DATE
2024-11-23T21:59:57.442000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-150577date:2019-10-09T00:00:00
db:VULMONid:CVE-2019-1825date:2019-10-09T00:00:00
db:BIDid:108337date:2019-05-15T00:00:00
db:JVNDBid:JVNDB-2019-004655date:2019-06-05T00:00:00
db:CNNVDid:CNNVD-201905-698date:2019-05-21T00:00:00
db:NVDid:CVE-2019-1825date:2024-11-21T04:37:28.623

SOURCES RELEASE DATE
db:VULHUBid:VHN-150577date:2019-05-16T00:00:00
db:VULMONid:CVE-2019-1825date:2019-05-16T00:00:00
db:BIDid:108337date:2019-05-15T00:00:00
db:JVNDBid:JVNDB-2019-004655date:2019-06-05T00:00:00
db:CNNVDid:CNNVD-201905-698date:2019-05-15T00:00:00
db:NVDid:CVE-2019-1825date:2019-05-16T01:29:00.750