CVE-2020-3339

Name of the Vulnerable Software and Affected Versions Cisco Prime Infrastructure (affected versions not specified)

Description The issue is related to a vulnerability in the web-based management interface, allowing an authenticated, remote attacker to conduct SQL injection attacks. This is due to improper validation of user-submitted parameters, such as username and password. An attacker could exploit this by sending malicious requests to the system, potentially obtaining and modifying sensitive information stored in the underlying database. The vulnerability is also described as related to the lack of protection against SQL query structure attacks, which could allow a remote attacker to execute arbitrary SQL queries.

Recommendations For Cisco Prime Infrastructure, consider restricting access to the web-based management interface until a fix is available. As a temporary workaround, avoid using user-submitted parameters in the affected system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.