What is CVE-2020-3154?

CVE-2020-3154 is a medium-severity vulnerability in Cisco Cloud Web Security, classified under SQL Injection. CVSS score: 4.9/10. Published 2020-02-19.

How severe is CVE-2020-3154?

Medium severity. CVSS v3 base score is 4.9 out of 10.

SQL Injection in Cisco Cloud Web Security

CVE-2020-3154

A vulnerability in the web UI of Cisco Cloud Web Security (CWS) could allow an authenticated, remote attacker to execute arbitrary SQL queries. The vulnerability exists because the web-based management interface improperly validates SQL values. An authenticated attacker could exploit this vulnerability sending malicious requests to the affected device. An exploit could allow the attacker to modify values on or return values from the underlying database.

Vulnerability class: SQL Injection

EPSS: 0.009 (55.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 4.9 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N.

Affected products

Cisco Cloud Web Security — versions unspecified
Cisco Cloud_web_security — versions 5.2\(0\)

Weakness classification (CWE)

CWE-89 — SQL Injection

References

psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)

Frequently asked questions

What is CVE-2020-3154?: CVE-2020-3154 is a medium-severity vulnerability in Cisco Cloud Web Security, classified under SQL Injection. CVSS score: 4.9/10. Published 2020-02-19.
How severe is CVE-2020-3154?: Medium severity. CVSS v3 base score is 4.9 out of 10.