CVE-2019-15984

🗓️ 06 Jan 2020 07:45:26Reported by ciscoType

cve🔗 web.nvd.nist.gov👁 85 Views🌐 WEB

Vulnerabilities in Cisco DCNM REST and SOAP API endpoints

Reporter	Title	Published	Views	Family All 116
0day.today	Cisco Data Center Network Manager 11.2.1 - (getVmHostData) SQL Injection Exploit	6 Feb 202000:00	–	zdt
BDU FSTEC	The vulnerability of the REST API interface of the Cisco Data Center Network Manager system allows a perpetrator to gain unauthorized access to protected information, affect data integrity, or execute arbitrary commands on the underlying operating system.	29 Jan 202000:00	–	bdu_fstec
Circl	CVE-2019-15984	6 Feb 202000:00	–	circl
Cisco	Cisco Data Center Network Manager SQL Injection Vulnerabilities	2 Jan 202016:00	–	cisco
Tenable Nessus	Cisco Data Center Network Manager < 11.3(1) Multiple Vulnerabilities	9 Jan 202000:00	–	nessus
CNVD	Cisco Data Center Network Manager REST API SQL Injection Vulnerability	3 Jan 202000:00	–	cnvd
Check Point Advisories	Cisco Data Center Network Manager SQL Injection (CVE-2019-15984)	10 May 202000:00	–	checkpoint_advisories
Cvelist	CVE-2019-15984 Cisco Data Center Network Manager SQL Injection Vulnerabilities	6 Jan 202007:45	–	cvelist
Exploit DB	Cisco Data Center Network Manager 11.2.1 - 'getVmHostData' SQL Injection	6 Feb 202000:00	–	exploitdb
exploitpack	Cisco Data Center Network Manager 11.2.1 - getVmHostData SQL Injection	6 Feb 202000:00	–	exploitpack

NVD

Node

cisco data_center_network_managerRange<11.3(1)

[
  {
    "product": "Cisco Data Center Network Manager",
    "vendor": "Cisco",
    "versions": [
      {
        "lessThan": "n/a",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200102-dcnm-sql-inject
packetstormsecurity	www.packetstormsecurity.com/files/156239/Cisco-Data-Center-Network-Manager-11.2.1-SQL-Injection.html

Parameter	Position	Path	Description	CWE
colFilterStr	query param	/PortMapperWS/getPortMappingDataLength	SQL injection due to improper validation of user-supplied colFilterStr used to construct SQL queries in getPortMappingDataLength.	CWE-89

17 Jun 2026 02:21Current

8.1High risk

Vulners AI Score8.1

CVSS 3.17.2

CVSS 29

CVSS 37.2

EPSS0.46935

SSVC

CWE-89