Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2024-08854

Опубликовано: 23 окт. 2024
Источник: fstec
CVSS3: 6.5
CVSS2: 8.5
EPSS Низкий

Описание

Уязвимость веб-интерфейса управления программного обеспечения администрирования сети Cisco Secure Firewall Management Center (ранее Cisco Firepower Management Center) связана с непринятием мер по защите структуры SQL-запроса. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код

Вендор

Cisco Systems Inc.

Наименование ПО

Cisco Secure Firewall Management Center

Версия ПО

06.02.2003 (Cisco Secure Firewall Management Center)
6.2.3.1 (Cisco Secure Firewall Management Center)
6.2.3.2 (Cisco Secure Firewall Management Center)
6.2.3.3 (Cisco Secure Firewall Management Center)
6.2.3.4 (Cisco Secure Firewall Management Center)
6.2.3.5 (Cisco Secure Firewall Management Center)
6.2.3.6 (Cisco Secure Firewall Management Center)
6.2.3.7 (Cisco Secure Firewall Management Center)
6.2.3.9 (Cisco Secure Firewall Management Center)
6.2.3.10 (Cisco Secure Firewall Management Center)
6.2.3.11 (Cisco Secure Firewall Management Center)
6.2.3.12 (Cisco Secure Firewall Management Center)
6.2.3.13 (Cisco Secure Firewall Management Center)
6.2.3.14 (Cisco Secure Firewall Management Center)
6.2.3.15 (Cisco Secure Firewall Management Center)
6.2.3.8 (Cisco Secure Firewall Management Center)
6.2.3.16 (Cisco Secure Firewall Management Center)
6.2.3.17 (Cisco Secure Firewall Management Center)
6.2.3.18 (Cisco Secure Firewall Management Center)
06.04.2000 (Cisco Secure Firewall Management Center)
6.4.0.1 (Cisco Secure Firewall Management Center)
6.4.0.3 (Cisco Secure Firewall Management Center)
6.4.0.2 (Cisco Secure Firewall Management Center)
6.4.0.4 (Cisco Secure Firewall Management Center)
6.4.0.5 (Cisco Secure Firewall Management Center)
6.4.0.6 (Cisco Secure Firewall Management Center)
6.4.0.7 (Cisco Secure Firewall Management Center)
6.4.0.8 (Cisco Secure Firewall Management Center)
6.4.0.9 (Cisco Secure Firewall Management Center)
6.4.0.10 (Cisco Secure Firewall Management Center)
6.4.0.11 (Cisco Secure Firewall Management Center)
6.4.0.12 (Cisco Secure Firewall Management Center)
6.4.0.13 (Cisco Secure Firewall Management Center)
6.4.0.14 (Cisco Secure Firewall Management Center)
6.4.0.15 (Cisco Secure Firewall Management Center)
6.4.0.16 (Cisco Secure Firewall Management Center)
6.4.0.17 (Cisco Secure Firewall Management Center)
6.4.0.18 (Cisco Secure Firewall Management Center)
06.06.2000 (Cisco Secure Firewall Management Center)
6.6.0.1 (Cisco Secure Firewall Management Center)
06.06.2001 (Cisco Secure Firewall Management Center)
06.06.2003 (Cisco Secure Firewall Management Center)
06.06.2004 (Cisco Secure Firewall Management Center)
06.06.2005 (Cisco Secure Firewall Management Center)
6.6.5.1 (Cisco Secure Firewall Management Center)
6.6.5.2 (Cisco Secure Firewall Management Center)
06.06.2007 (Cisco Secure Firewall Management Center)
6.6.7.1 (Cisco Secure Firewall Management Center)
6.6.7.2 (Cisco Secure Firewall Management Center)
06.07.2000 (Cisco Secure Firewall Management Center)
6.7.0.1 (Cisco Secure Firewall Management Center)
6.7.0.2 (Cisco Secure Firewall Management Center)
6.7.0.3 (Cisco Secure Firewall Management Center)
7.0.0 (Cisco Secure Firewall Management Center)
7.0.0.1 (Cisco Secure Firewall Management Center)
7.0.1 (Cisco Secure Firewall Management Center)
7.0.1.1 (Cisco Secure Firewall Management Center)
7.0.2 (Cisco Secure Firewall Management Center)
7.0.2.1 (Cisco Secure Firewall Management Center)
7.0.3 (Cisco Secure Firewall Management Center)
7.0.4 (Cisco Secure Firewall Management Center)
7.0.5 (Cisco Secure Firewall Management Center)
7.0.6 (Cisco Secure Firewall Management Center)
7.0.6.1 (Cisco Secure Firewall Management Center)
7.0.6.2 (Cisco Secure Firewall Management Center)
07.01.2000 (Cisco Secure Firewall Management Center)
7.1.0.1 (Cisco Secure Firewall Management Center)
7.1.0.2 (Cisco Secure Firewall Management Center)
7.1.0.3 (Cisco Secure Firewall Management Center)
07.02.2000 (Cisco Secure Firewall Management Center)
07.02.2001 (Cisco Secure Firewall Management Center)
07.02.2002 (Cisco Secure Firewall Management Center)
7.2.0.1 (Cisco Secure Firewall Management Center)
07.02.2003 (Cisco Secure Firewall Management Center)
7.2.3.1 (Cisco Secure Firewall Management Center)
07.02.2004 (Cisco Secure Firewall Management Center)
7.2.4.1 (Cisco Secure Firewall Management Center)
07.02.2005 (Cisco Secure Firewall Management Center)
7.2.5.1 (Cisco Secure Firewall Management Center)
07.02.2006 (Cisco Secure Firewall Management Center)
07.02.2007 (Cisco Secure Firewall Management Center)
7.2.5.2 (Cisco Secure Firewall Management Center)
07.02.2008 (Cisco Secure Firewall Management Center)
7.2.8.1 (Cisco Secure Firewall Management Center)
07.03.2000 (Cisco Secure Firewall Management Center)
07.03.2001 (Cisco Secure Firewall Management Center)
7.3.1.1 (Cisco Secure Firewall Management Center)
7.3.1.2 (Cisco Secure Firewall Management Center)
07.04.2000 (Cisco Secure Firewall Management Center)
07.04.2001 (Cisco Secure Firewall Management Center)
7.4.1.1 (Cisco Secure Firewall Management Center)

Тип ПО

ПО программно-аппаратных средств защиты

Операционные системы и аппаратные платформы

-

Уровень опасности уязвимости

Высокий уровень опасности (базовая оценка CVSS 2.0 составляет 8,5)
Средний уровень опасности (базовая оценка CVSS 3.0 составляет 6,5)

Возможные меры по устранению уязвимости

Использование рекомендаций производителя:
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-sql-inj-LOYAFcfq

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 23%
0.00073
Низкий

6.5 Medium

CVSS3

8.5 High

CVSS2

Связанные уязвимости

CVSS3: 6.5
nvd
10 месяцев назад

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface does not validate user input adequately. An attacker could exploit this vulnerability by authenticating to the application as an Administrator and sending crafted SQL queries to an affected system. A successful exploit could allow the attacker to obtain unauthorized data from the database and make changes to the system. To exploit this vulnerability, an attacker would need Administrator-level privileges.

CVSS3: 6.5
github
10 месяцев назад

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface does not validate user input adequately. An attacker could exploit this vulnerability by authenticating to the application as an Administrator and sending crafted SQL queries to an affected system. A successful exploit could allow the attacker to obtain unauthorized data from the database and make changes to the system. To exploit this vulnerability, an attacker would need Administrator-level privileges.

EPSS

Процентиль: 23%
0.00073
Низкий

6.5 Medium

CVSS3

8.5 High

CVSS2