CVE-2019-15995CWE-89

Cisco DNA Spaces: Connector SQL Injection Vulnerability

Medium · published November 26, 2019

CVSS v3.0
6.5
EPSS
1%
Percentile
66.6
In the wild
Unconfirmed
What it is

A vulnerability in the web UI of Cisco DNA Spaces: Connector could allow an authenticated, remote attacker to execute arbitrary SQL queries. The vulnerability exists because the web UI does not properly validate user-supplied input. An attacker could exploit this vulnerability by entering malicious SQL statements in an affected field in the web UI. A successful exploit could allow the attacker to remove the SQL database, which would require the reinstallation of the Connector VM.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01150 · 66.6th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2019-11-26T03:41Z
EPSS history
Timeline
  • 26 NOV 03:41Z
    Cisco DNA Spaces: Connector SQL Injection Vulnerability
    cvelistv5