Description
SQL injection vulnerability in the web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCtq65669.
References (5)
Core 5
Core References
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/45355
Vendor Advisory vendor-advisory
x_refsource_cisco
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b8915e.shtml
Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://securitytracker.com/id?1025810
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/68737
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/48812
Scores
EPSS
0.0109
EPSS Percentile
62.0%
Details
CWE
CWE-89
Status
published
Products (11)
cisco/sa500_software
1.0.14
cisco/sa500_software
1.0.15
cisco/sa500_software
1.0.17
cisco/sa500_software
1.0.39
cisco/sa500_software
1.1.21
cisco/sa500_software
1.1.42
cisco/sa500_software
1.1.65
cisco/sa500_software
< 2.1.18
cisco/sa520
cisco/sa520w
... and 1 more
Published
Jul 28, 2011
Tracked Since
Feb 18, 2026