CVE-2018-15447 MEDIUM

CVE-2018-15447: Cisco Integrated Management Controller Supervisor SQL Injection Vulnerability

Vendor Cisco
Product Cisco Integrated Management Controller (IMC) Supervisor
Weakness CWE-89 · SQLi
Published November 8, 2018
Last update November 26, 2024
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

A vulnerability in the web framework code of Cisco Integrated Management Controller (IMC) Supervisor could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The vulnerability is due to a lack of proper validation of user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious SQL statements to the affected application.

Key dates

02Disclosure timeline

November 8, 2018 CVE published
November 26, 2024 Record updated