CVE-2018-15441
Cisco Prime License Manager SQL Injection Vulnerability
Vexday Risk Score
28Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 9.4EPSS 3.7%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Lifecycle
28 Nov 2018Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
A vulnerability in the web framework code of Cisco Prime License Manager (PLM) could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The vulnerability is due to a lack of proper validation of user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending crafted HTTP POST requests that contain malicious SQL statements to an affected application. A successful exploit could allow the attacker to modify and delete arbitrary data in the PLM database or gain shell access with the privileges of the postgres user.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Affected products
Cisco · Cisco Prime License ManagerWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →