CVE-2020-3378

🗓️ 16 Jul 2020 17:21:46Reported by ciscoType

A vulnerability in the web-based management interface for Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to impact the integrity of an affected system by executing arbitrary SQL queries. The vulnerability is due to insufficient validation of user-supplied input

Reporter	Title	Published	Views	Family All 10
Cisco	Cisco SD-WAN vManage Software SQL Injection Vulnerability	15 Jul 202016:00	–	cisco
Tenable Nessus	Cisco SD-WAN vManage Software SQLi (cisco-sa-sivm-M8wugR9O)	15 Mar 202100:00	–	nessus
CNVD	Cisco SD-WAN vManage Software SQL Injection Vulnerability (CNVD-2020-42256)	23 Jul 202000:00	–	cnvd
Cvelist	CVE-2020-3378 Cisco SD-WAN vManage Software SQL Injection Vulnerability	16 Jul 202017:21	–	cvelist
EUVD	EUVD-2020-24649	7 Oct 202500:30	–	euvd
NVD	CVE-2020-3378	16 Jul 202018:15	–	nvd
OSV	CVE-2020-3378	16 Jul 202018:15	–	osv
Prion	Sql injection	16 Jul 202018:15	–	prion
Positive Technologies	PT-2020-3131 · Cisco · Cisco Sd-Wan Vmanage	15 Jul 202000:00	–	ptsecurity
Vulnrichment	CVE-2020-3378 Cisco SD-WAN vManage Software SQL Injection Vulnerability	16 Jul 202017:21	–	vulnrichment

NVD

Node

cisco sd-wan_firmwareRange<18.4.5

cisco sd-wan_firmwareRange19.2.0–19.2.3

AND

cisco 1100-4g_integrated_services_routerMatch-

cisco 1100-4gltegb_integrated_services_routerMatch-

cisco 1100-4gltena_integrated_services_routerMatch-

cisco 1100-6g_integrated_services_routerMatch-

cisco vedge_100Match-

cisco vedge_1000Match-

cisco vedge_100bMatch-

cisco vedge_100mMatch-

cisco vedge_100wmMatch-

cisco vedge_2000Match-

cisco vedge_5000Match-

[
  {
    "product": "Cisco SD-WAN vManage",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

Source	Link
tools	www.tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sivm-M8wugR9O

21 Nov 2024 05:30Current

5Medium risk

Vulners AI Score5

CVSS 24

CVSS 3.14.3

CVSS 34.3

EPSS0.00163

SSVC

CWE-89