Vulnerability · Published Feb 19, 2020 · Assigned by cisco

CVE-2020-3154Cisco Cloud Web Security SQL Injection Vulnerability

Medium 4.9

In plain English

A medium-severity SQL injection in Cisco Cloud Web Security from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 3.0)4.9Medium

Exploit odds (30 days)0.9%top 41.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in the web UI of Cisco Cloud Web Security (CWS) could allow an authenticated, remote attacker to execute arbitrary SQL queries. The vulnerability exists because the web-based management interface improperly validates SQL values. An authenticated attacker could exploit this vulnerability sending malicious requests to the affected device. An exploit could allow the attacker to modify values on or return values from the underlying database.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco Cloud Web Security	unspecified – before n/a

Weakness: CWE-89 · Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

References

20200219 Cisco Cloud Web Security SQL Injection Vulnerability vendor-advisory, x_refsource_CISCO