CVE-2019-1825
Description
A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute arbitrary SQL queries. This vulnerability exist because the software improperly validates user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains malicious SQL statements to the affected application. A successful exploit could allow the attacker to view or modify entries in some database tables, affecting the integrity of the data.
Risk Information
Base Score
8.1
MODERATE
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score
Exploitation Probability
0.317
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerabilities For Cisco Prime Infrastructure | NCM |
| Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerabilities For Cisco Evolved Programmable Network Manager | NCM |
| Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) Vulnerability (CVE-2019-1825) | NCM |
Patch Details
Click to see the patches provided by ManageEngine for this CVE
| Patch ID | Patch Description |
|---|---|
| PATCH-1705595 | Security Update for Cisco Prime Infrastructure 2.2(2) |
| PATCH-1705983 | Security Update for Cisco Evolved Programmable Network Manager 2.0(2.0.40) |
References
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234