CVE-2014-3275

2014-05-2600:25:31

CWE-89

[email protected]

web.nvd.nist.gov

cve-2014-3275

sql injection

cisco

ise

security vulnerability

nvd

cve

8.1 High

AI Score

Confidence

High

6.5 Medium

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

55.2%

JSON

SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCul21337.

Affected configurations

NVD

Node

ciscoidentity_services_engine_softwareRange≤1.2

ciscoidentity_services_engine_softwareMatch1.0

ciscoidentity_services_engine_softwareMatch1.1

CPENameOperatorVersion
cisco:identity_services_engine_softwarecisco identity services engine softwarele1.2
cisco:identity_services_engine_softwarecisco identity services engine softwareeq1.0
cisco:identity_services_engine_softwarecisco identity services engine softwareeq1.1

CPE	Name	Operator	Version
cisco:identity_services_engine_software	cisco identity services engine software	le	1.2
cisco:identity_services_engine_software	cisco identity services engine software	eq	1.0
cisco:identity_services_engine_software	cisco identity services engine software	eq	1.1