VulnerabilityModified
CVE-2014-3275
SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCul21337.
MEDIUM 6.5EPSS 1.56%
Does this matter?
Lower severity and a low EPSS score (1.56%). Track it; it rarely justifies an emergency change on its own.
Description
SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCul21337.
- CVSS 2.0
- 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
- EPSS
- 1.56% probability · 74th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89
- Affected
- cisco/identity services engine software
- Source
- psirt@cisco.com
References
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3275Vendor Advisory
- http://tools.cisco.com/security/center/viewAlert.x?alertId=34328Vendor Advisory
- http://www.securityfocus.com/bid/67555
- http://www.securitytracker.com/id/1030273
- http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3275Vendor Advisory
- http://tools.cisco.com/security/center/viewAlert.x?alertId=34328Vendor Advisory
- http://www.securityfocus.com/bid/67555
- http://www.securitytracker.com/id/1030273
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.