CVE-2014-3275

Cisco Identity Services Engine Software < 1.2 - Authenticated SQL Injection via Crafted URL

Title source: llm

Description

SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2(.1 patch 2) and earlier allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCul21337.

References (4)

Core 4

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/67555

Vendor Advisory vendor-advisory x_refsource_cisco

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3275

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1030273

Vendor Advisory x_refsource_confirm

http://tools.cisco.com/security/center/viewAlert.x?alertId=34328

Scores

EPSS 0.0156

EPSS Percentile 72.6%

Details

CWE

CWE-89

Status published

Products (3)

cisco/identity_services_engine_software 1.0

cisco/identity_services_engine_software 1.1

cisco/identity_services_engine_software < 1.2

Published May 26, 2014

Tracked Since Feb 18, 2026