CVE-2013-5525: SQL Injection
First published: Thu Oct 10 2013(Updated: )
SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCug90502.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Identity Services Engine | <=1.2 | |
| Cisco Identity Services Engine | =1.0 | |
| Cisco Identity Services Engine | =1.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://osvdb.org/98167
- http://secunia.com/advisories/55098
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5525
- http://tools.cisco.com/security/center/viewAlert.x?alertId=31160
- http://www.securitytracker.com/id/1029156
- https://exchange.xforce.ibmcloud.com/vulnerabilities/87723
Frequently Asked Questions
What is the severity of CVE-2013-5525?
CVE-2013-5525 has a high severity rating due to its ability to allow authenticated users to execute arbitrary SQL commands.
How do I fix CVE-2013-5525?
To fix CVE-2013-5525, upgrade to a version later than Cisco Identity Services Engine 1.2.
Who is affected by CVE-2013-5525?
CVE-2013-5525 affects users of Cisco Identity Services Engine software versions 1.2 and earlier.
What type of vulnerability is CVE-2013-5525?
CVE-2013-5525 is classified as an SQL injection vulnerability.
What can attackers do with CVE-2013-5525?
Attackers exploiting CVE-2013-5525 can execute arbitrary SQL commands on the affected system.
- agent/softwarecombine
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco identity services engine
- version/cisco identity services engine/1.2
- version/cisco identity services engine/1.0
- version/cisco identity services engine/1.1