CVE-2016-6443: SQL Injection

Published Oct 27, 2016

Updated

A vulnerability in the Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL database interface could allow an authenticated, remote attacker to impact system confidentiality by executing a subset of arbitrary SQL queries that can cause product instability. More Information: CSCva27038, CSCva28335. Known Affected Releases: 3.1(0.128), 1.2(400), 2.0(1.0.34A).

Affected Software

18 affected components

cisco Evolved Programmable Network Manager=1.2

cisco Evolved Programmable Network Manager=2.0

cisco Prime Infrastructure=1.2

cisco Prime Infrastructure=1.2.0.103

cisco Prime Infrastructure=1.2.1

cisco Prime Infrastructure=1.3

cisco Prime Infrastructure=1.3.0.20

cisco Prime Infrastructure=1.4

cisco Prime Infrastructure=1.4.0.45

cisco Prime Infrastructure=1.4.1

cisco Prime Infrastructure=1.4.2

cisco Prime Infrastructure=2.0

cisco Prime Infrastructure=2.1.0

cisco Prime Infrastructure=2.2

cisco Prime Infrastructure=2.2\(2\)

cisco Prime Infrastructure=3.0

cisco Prime Infrastructure=3.1

cisco Prime Infrastructure=3.1.1

Event History

Oct 27, 2016

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2016-6443?

CVE-2016-6443 has a medium severity rating due to its potential impact on system confidentiality and stability.

How do I fix CVE-2016-6443?

To fix CVE-2016-6443, it is recommended to update to the latest version of affected Cisco software, as detailed in security advisories.

Who is affected by CVE-2016-6443?

CVE-2016-6443 affects users of Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure versions 1.2 through 3.1.1.

What types of systems are impacted by CVE-2016-6443?

CVE-2016-6443 impacts systems using the SQL database interface within Cisco Prime Infrastructure and Evolved Programmable Network Manager.

Can CVE-2016-6443 be exploited remotely?

Yes, CVE-2016-6443 can be exploited by an authenticated, remote attacker to execute arbitrary SQL queries.