CVE-2019-1824 is a SQL injection vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager. An authenticated, remote attacker can exploit this by sending crafted HTTP requests with malicious SQL statements due to improper input validation. This vulnerability carries a high CVSS score of 8.1, indicating that it is easily exploitable over the network with low complexity, allowing an attacker to view or modify database entries and compromise data integrity. While no public exploit code or active exploitation has been observed, the vulnerability has garnered some community discussion and media coverage, including an article from BleepingComputer.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.0.1CPE matchmatch criteria | cpe:2.3:a:cisco:evolved_programmable_network_manager:*:*:*:*:*:*:*:* | ||
< 3.4.1CPE matchmatch criteria | cpe:2.3:a:cisco:prime_infrastructure:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.