cisco-sa-20191120-dna-sqlinjection: Cisco DNA Spaces: Connector SQL Injection Vulnerability
First published: Wed Nov 20 2019(Updated: )
A vulnerability in the web UI of Cisco DNA Spaces: Connector could allow an authenticated, remote attacker to execute arbitrary SQL queries. The vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by entering malicious SQL statements in an affected field in the web UI. A successful exploit could allow the attacker to remove the SQL database, which would require the reinstallation of the Connector VM. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-dna-sqlinjection
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco DNA Spaces |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-20191120-dna-sqlinjection?
The severity of cisco-sa-20191120-dna-sqlinjection is considered critical due to its potential for remote SQL injection attacks.
How do I fix cisco-sa-20191120-dna-sqlinjection?
To fix cisco-sa-20191120-dna-sqlinjection, upgrade to the latest version of Cisco DNA Spaces: Connector where the vulnerability has been addressed.
Who is affected by cisco-sa-20191120-dna-sqlinjection?
Cisco DNA Spaces: Connector users with vulnerable versions are affected by cisco-sa-20191120-dna-sqlinjection.
What can an attacker achieve by exploiting cisco-sa-20191120-dna-sqlinjection?
An attacker exploiting cisco-sa-20191120-dna-sqlinjection can execute arbitrary SQL queries on the affected system.
Is authentication required to exploit cisco-sa-20191120-dna-sqlinjection?
Yes, authentication is required to exploit cisco-sa-20191120-dna-sqlinjection, as the vulnerability exists in the web UI accessed by authenticated users.
- agent/type
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/severity
- agent/weakness
- agent/title
- agent/references
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco dna spaces