CVE-2024-20360: SQL Injection
First published: Wed May 22 2024(Updated: )
A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface does not adequately validate user input. An attacker could exploit this vulnerability by authenticating to the application and sending crafted SQL queries to an affected system. A successful exploit could allow the attacker to obtain any data from the database, execute arbitrary commands on the underlying operating system, and elevate privileges to root. To exploit this vulnerability, an attacker would need at least Read Only user credentials.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Secure Firewall Management Center | >=7.0.0<=7.3.1.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-20360?
CVE-2024-20360 is classified as a critical vulnerability due to its potential for remote SQL injection attacks.
How do I fix CVE-2024-20360?
To mitigate CVE-2024-20360, ensure that your Cisco Firepower Management Center software is updated to a version above 7.3.1.2.
What systems are affected by CVE-2024-20360?
CVE-2024-20360 affects Cisco Secure Firewall Management Center versions between 7.0.0 and 7.3.1.2.
Who can exploit CVE-2024-20360?
An authenticated remote attacker can exploit CVE-2024-20360 to perform SQL injection attacks on vulnerable systems.
What are the potential impacts of CVE-2024-20360?
Exploitation of CVE-2024-20360 could lead to unauthorized access to database contents and potentially compromise the affected Cisco Firepower Management Center.
- agent/references
- agent/weakness
- agent/description
- agent/type
- agent/first-publish-date
- agent/severity
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco secure firewall management center
- version/cisco secure firewall management center/7.0.0
- version/cisco secure firewall management center/7.3.1.2