Sign-up

ID

VAR-201911-0944


CVE

CVE-2019-15995


TITLE

Cisco DNA Spaces: Connector In SQL Injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-012696

DESCRIPTION

A vulnerability in the web UI of Cisco DNA Spaces: Connector could allow an authenticated, remote attacker to execute arbitrary SQL queries. The vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by entering malicious SQL statements in an affected field in the web UI. A successful exploit could allow the attacker to remove the SQL database, which would require the reinstallation of the Connector VM. Cisco DNA Spaces is an indoor positioning service platform of Cisco (Cisco). Cisco DNA Spaces: Connector is one of the connectors used to support Cisco wireless controller communication

Trust: 1.71

sources: NVD: CVE-2019-15995 // JVNDB: JVNDB-2019-012696 // VULHUB: VHN-148097

AFFECTED PRODUCTS

vendor:ciscomodel:dna spaces\: connectorscope:ltversion:2.0

Trust: 1.0

vendor:ciscomodel:dna spaces: connectorscope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2019-012696 // NVD: CVE-2019-15995

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-15995
value: MEDIUM

Trust: 1.0

ykramarz@cisco.com: CVE-2019-15995
value: MEDIUM

Trust: 1.0

NVD: CVE-2019-15995
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201911-1192
value: MEDIUM

Trust: 0.6

VULHUB: VHN-148097
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2019-15995
severity: MEDIUM
baseScore: 5.5
vectorString: AV:N/AC:L/AU:S/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-148097
severity: MEDIUM
baseScore: 5.5
vectorString: AV:N/AC:L/AU:S/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

ykramarz@cisco.com: CVE-2019-15995
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.2
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2019-15995
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.2
impactScore: 5.2
version: 3.1

Trust: 1.0

sources: VULHUB: VHN-148097 // JVNDB: JVNDB-2019-012696 // CNNVD: CNNVD-201911-1192 // NVD: CVE-2019-15995 // NVD: CVE-2019-15995

PROBLEMTYPE DATA

problemtype:CWE-89

Trust: 1.9

sources: VULHUB: VHN-148097 // JVNDB: JVNDB-2019-012696 // NVD: CVE-2019-15995

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201911-1192

TYPE

SQL injection

Trust: 0.6

sources: CNNVD: CNNVD-201911-1192

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-012696

PATCH
title:cisco-sa-20191120-dna-sqlinjectionurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-dna-sqlinjection
Trust: 0.8
title:Cisco DNA Spaces:Connector SQL Repair measures for injecting vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=103135
Trust: 0.6
sources:
            
            
            JVNDB: JVNDB-2019-012696 // 
            
            
            
            CNNVD: CNNVD-201911-1192

EXTERNAL IDS
db:NVDid:CVE-2019-15995
Trust: 2.5
db:JVNDBid:JVNDB-2019-012696
Trust: 0.8
db:CNNVDid:CNNVD-201911-1192
Trust: 0.7
db:AUSCERTid:ESB-2019.4392
Trust: 0.6
db:VULHUBid:VHN-148097
Trust: 0.1
sources:
            
            
            VULHUB: VHN-148097 // 
            
            
            
            JVNDB: JVNDB-2019-012696 // 
            
            
            
            CNNVD: CNNVD-201911-1192 // 
            
            
            
            NVD: CVE-2019-15995

REFERENCES
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20191120-dna-sqlinjection
Trust: 2.3
url:https://nvd.nist.gov/vuln/detail/cve-2019-15995
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-15995
Trust: 0.8
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20191120-dna-cmd-injection
Trust: 0.6
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20191120-dna-priv-esca
Trust: 0.6
url:https://www.auscert.org.au/bulletins/esb-2019.4392/
Trust: 0.6
sources:
            
            
            VULHUB: VHN-148097 // 
            
            
            
            JVNDB: JVNDB-2019-012696 // 
            
            
            
            CNNVD: CNNVD-201911-1192 // 
            
            
            
            NVD: CVE-2019-15995

SOURCES
db:VULHUBid:VHN-148097
db:JVNDBid:JVNDB-2019-012696
db:CNNVDid:CNNVD-201911-1192
db:NVDid:CVE-2019-15995

LAST UPDATE DATE
2024-11-23T22:16:46.783000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-148097date:2019-12-09T00:00:00
db:JVNDBid:JVNDB-2019-012696date:2019-12-11T00:00:00
db:CNNVDid:CNNVD-201911-1192date:2019-12-10T00:00:00
db:NVDid:CVE-2019-15995date:2024-11-21T04:29:53.730

SOURCES RELEASE DATE
db:VULHUBid:VHN-148097date:2019-11-26T00:00:00
db:JVNDBid:JVNDB-2019-012696date:2019-12-11T00:00:00
db:CNNVDid:CNNVD-201911-1192date:2019-11-20T00:00:00
db:NVDid:CVE-2019-15995date:2019-11-26T04:15:12.247