cisco-sa-vmanage-cql-inject-72EhnUc: Cisco SD-WAN vManage Cypher Query Language Injection Vulnerability
First published: Wed Jan 20 2021(Updated: )
A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to conduct Cypher query language injection attacks on an affected system. The vulnerability is due to insufficient input validation by the web-based management interface. An attacker could exploit this vulnerability by sending crafted HTTP requests to the interface of an affected system. A successful exploit could allow the attacker to obtain sensitive information. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-vmanage-cql-inject-72EhnUc
Credit: the following people for independently reporting this vulnerability:
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco SD-WAN vManage |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-vmanage-cql-inject-72EhnUc?
The severity of cisco-sa-vmanage-cql-inject-72EhnUc is categorized as high due to the potential impact of Cypher query language injection attacks.
How do I fix cisco-sa-vmanage-cql-inject-72EhnUc?
To fix cisco-sa-vmanage-cql-inject-72EhnUc, upgrade to the latest version of Cisco SD-WAN vManage Software that addresses this vulnerability.
Who is affected by cisco-sa-vmanage-cql-inject-72EhnUc?
The vulnerability cisco-sa-vmanage-cql-inject-72EhnUc affects organizations using Cisco SD-WAN vManage Software.
What is a Cypher query language injection attack related to cisco-sa-vmanage-cql-inject-72EhnUc?
A Cypher query language injection attack allows an authenticated attacker to manipulate database queries through the web-based management interface.
Can cisco-sa-vmanage-cql-inject-72EhnUc be exploited remotely?
Yes, cisco-sa-vmanage-cql-inject-72EhnUc can be exploited remotely by authenticated attackers.
- agent/type
- agent/first-publish-date
- agent/event
- collector/cisco-advisory
- source/Cisco
- agent/severity
- agent/references
- agent/last-modified-date
- agent/title
- agent/weakness
- agent/author
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco sd-wan vmanage