CVE-2019-1942: Cisco Identity Services Engine Blind SQL Injection Vulnerability
First published: Wed Jul 17 2019(Updated: )
A vulnerability in the sponsor portal web interface for Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to impact the integrity of an affected system by executing arbitrary SQL queries. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted input that includes SQL statements to an affected system. A successful exploit could allow the attacker to modify entries in some database tables, affecting the integrity of the data. At the time of publication, this vulnerability affected Cisco ISE running software releases 2.6.0 and prior.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Identity Services Engine | <=2.6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-1942?
CVE-2019-1942 is a vulnerability in the sponsor portal web interface for Cisco Identity Services Engine (ISE) that allows an authenticated, remote attacker to execute arbitrary SQL queries.
How does CVE-2019-1942 impact the system?
CVE-2019-1942 allows an attacker to impact the integrity of an affected system by executing arbitrary SQL queries.
What is the severity of CVE-2019-1942?
The severity of CVE-2019-1942 is medium with a CVSS score of 6.5.
How can I fix CVE-2019-1942?
To fix CVE-2019-1942, update to a version of Cisco Identity Services Engine (ISE) that is not affected by the vulnerability.
Are there any references for CVE-2019-1942?
Yes, you can find more information about CVE-2019-1942 in the following references: [SecurityFocus](http://www.securityfocus.com/bid/109283) and [Cisco Security Advisory](https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-ise-sql-inject).
- collector/nvd-index
- agent/type
- agent/references
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/title
- agent/last-modified-date
- agent/author
- agent/first-publish-date
- agent/tags
- agent/description
- agent/event
- vendor/cisco
- canonical/cisco identity services engine
- version/cisco identity services engine/2.6.0