CVE-2019-1824: Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerabilities
First published: Thu May 16 2019(Updated: )
A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute arbitrary SQL queries. This vulnerability exist because the software improperly validates user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains malicious SQL statements to the affected application. A successful exploit could allow the attacker to view or modify entries in some database tables, affecting the integrity of the data.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Evolved Programmable Network Manager | <3.0.1 | |
| Cisco Prime Infrastructure | <3.4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-1824?
CVE-2019-1824 is a vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager that allows an authenticated, remote attacker to execute arbitrary SQL queries.
How severe is CVE-2019-1824?
CVE-2019-1824 has a severity score of 8.1 out of 10, indicating a high severity level.
Which software versions are affected by CVE-2019-1824?
CVE-2019-1824 affects Cisco Prime Infrastructure versions up to and excluding 3.4.1, and Cisco Evolved Programmable Network Manager versions up to and excluding 3.0.1.
How can an attacker exploit CVE-2019-1824?
An attacker can exploit CVE-2019-1824 by supplying malicious SQL queries through the web-based management interface of the affected Cisco products.
Where can I find more information about CVE-2019-1824?
You can find more information about CVE-2019-1824 on the following websites: [SecurityFocus](http://www.securityfocus.com/bid/108337) and [Cisco Security Advisory](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-sqlinject).
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/author
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- vendor/cisco
- canonical/cisco evolved programmable network manager
- canonical/cisco prime infrastructure