cisco-sa-20180606-prime-sql: Cisco Prime Collaboration Provisioning SQL Injection Vulnerability
A vulnerability in the web framework code of Cisco Prime Collaboration Provisioning (PCP) could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The vulnerability is due to a lack of proper validation on user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious SQL statements to the affected application.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-prime-sql
Affected Software
Event History
Frequently Asked Questions
What is the severity of cisco-sa-20180606-prime-sql?
The severity of cisco-sa-20180606-prime-sql is critical due to its potential for unauthorized access and execution of arbitrary SQL queries.
How do I fix cisco-sa-20180606-prime-sql?
To fix cisco-sa-20180606-prime-sql, you should update Cisco Prime Collaboration Provisioning to the latest version as outlined in the security advisory.
What causes the vulnerability cisco-sa-20180606-prime-sql?
The cisco-sa-20180606-prime-sql vulnerability is caused by insufficient validation of user-supplied input in SQL queries.
Who is affected by cisco-sa-20180606-prime-sql?
Organizations using Cisco Prime Collaboration Provisioning are affected by the cisco-sa-20180606-prime-sql vulnerability.
Can cisco-sa-20180606-prime-sql be exploited remotely?
Yes, cisco-sa-20180606-prime-sql can be exploited by an unauthenticated remote attacker.