SQL Injection in Cisco Prime Service Catalog

CVE-2015-6350

SQL injection vulnerability in the web framework in Cisco Prime Service Catalog 11.0 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuw50843.

Vulnerability class: SQL Injection

EPSS: 0.014 (68.9th percentile) — read the EPSS interpretation.

Affected products

Cisco Prime_service_catalog — versions 11.0_base
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
psirt@cisco.com (vdb-entry, x_refsource_SECTRACK)