CVE-2019-1825: Cisco Prime Infrastructure and Evolved Programmable Network Manager SQL Injection Vulnerabilities
A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute arbitrary SQL queries. This vulnerability exist because the software improperly validates user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains malicious SQL statements to the affected application. A successful exploit could allow the attacker to view or modify entries in some database tables, affecting the integrity of the data.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-1825?
CVE-2019-1825 is a vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager that allows an authenticated, remote attacker to execute arbitrary SQL queries.
What is the severity of CVE-2019-1825?
CVE-2019-1825 has a severity rating of 8.1 (high).
How does CVE-2019-1825 occur?
CVE-2019-1825 occurs because the software improperly validates user-supplied input in the web-based management interface, allowing an attacker to execute SQL queries.
Which software versions are affected by CVE-2019-1825?
Cisco Evolved Programmable Network Manager up to version 3.0.1, Cisco Network Level Service version 3.0 (0.0.83b), and Cisco Prime Infrastructure up to version 3.4.1 are affected by CVE-2019-1825.
How can I fix CVE-2019-1825?
Update your Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager software to a version that includes the necessary security patch or fix provided by Cisco.