—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA1

Cisco Security Advisory: Cisco Prime Collaboration Provisioning Authenticated SQL Injection Vulnerability

Advisory ID: cisco-sa-20171101-cpcp

Revision: 1.0

For Public Release: 2017 November 1 16:00 GMT

Last Updated: 2017 November 1 16:00 GMT

CVE ID(s): CVE-2017-12276

CVSS Score v(3): 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

+———————————————————————

Summary
=======
A vulnerability in the web framework code for the SQL database interface of the Cisco Prime Collaboration Provisioning application could allow an authenticated, remote attacker to impact the confidentiality and integrity of the application by executing arbitrary SQL queries. The attacker could read or write information from the SQL database.

The vulnerability is due to a lack of proper validation on user-supplied input within SQL queries. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious SQL statements to the affected application. An exploit could allow the attacker to determine the presence of certain values and write malicious input in the SQL database. The attacker would need to have valid user credentials.

Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

This advisory is available at the following link:
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-cpcp [“https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171101-cpcp”]

—–BEGIN PGP SIGNATURE—–

iQKBBAEBAgBrBQJZ+fHYZBxDaXNjbyBTeXN0ZW1zIFByb2R1Y3QgU2VjdXJpdHkg
SW5jaWRlbnQgUmVzcG9uc2UgVGVhbSAoQ2lzY28gUFNJUlQga2V5IDIwMTYtMjAx
NykgPHBzaXJ0QGNpc2NvLmNvbT4ACgkQrz2APcQAkHkAhw/+PwA+9RmPow9eWunn
WJ+L7mtYh9vZKYPNy0LYDcqGu65YzYxW5m9lVaLs7+ScdJMRYSZJBvQ6CV0rmIid
WbZCS5ipYyt0CAq0ernnKBk9r3Zs8gglPDSjlx13of2Fa3rfoZWGrovRADD/PPYA
2MU2XVvZAhsfKfXoaizR6BuW1UiS0YwABvy/Sg6pfy0muLrjpnOypl/h3+X1eRQ/
aEhvh320xvp/PQMw1Cr4xKVmpz3QSppFJC/Z0BlZRpN69jnF4BbdTDpcBiHmOype
o5jy/YCLSAcImF2d1cldacbGkBAbV3XMlUNHGqyRzLsydvVadLBPPDjsTHE6z3Bi
K0tKPees2nqg977QjNyIMHWyFBzuYkz7v8abXnMRRbImu/S/xxETL2LZ0jcijCD+
GOKVzluEHrXGz/+NOxxK6ZS2yPEYuSWiCBfJkFF908iXYxxJN+3JtNH85LB5ByAd
izXr94sgi5yRv5k5VUglwwRKx5e9xD9D4NyyzIfTmaNNliCSUl0FjP5j8aev3y3n
n+OFQgTkkzNwoLwVRzw/r/8sVQuq+VTU71WJDPWlMRbM6BCNuUURs8Wbk+gfCZsg
x+AW7JL5ebwXoFMPNBARPTj5kZz42pOlewouUUqlHn6XIXjm64vfOxyPQXyM75S8
ejGswYHGEDJwZiSg2+5rQdbQzjA=
=yglx
—–END PGP SIGNATURE—–

_______________________________________________
cust-security-announce mailing list
cust-security-announce@cisco.com
To unsubscribe, send the command “unsubscribe” in the subject of your message to cust-security-announce-leave@cisco.com