NVD Vulnerability Detail

CVE-2019-1942

Summary	A vulnerability in the sponsor portal web interface for Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to impact the integrity of an affected system by executing arbitrary SQL queries. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted input that includes SQL statements to an affected system. A successful exploit could allow the attacker to modify entries in some database tables, affecting the integrity of the data. At the time of publication, this vulnerability affected Cisco ISE running software releases 2.6.0 and prior.
Publication Date	July 18, 2019, 6:15 a.m.
Registration Date	Jan. 26, 2021, 11:41 a.m.
Last Update	Nov. 21, 2024, 1:37 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:cisco:identity_services_engine::::::::			2.6.0

Related information, measures and tools

No	URL	タグ
1	http://www.securityfocus.com/bid/109283	Third Party Advisory VDB Entry
2	http://www.securityfocus.com/bid/109283	Third Party Advisory VDB Entry
3	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-ise-sql-inject	Vendor Advisory
4	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-ise-sql-inject	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-89	SQLインジェクション	https://cwe.mitre.org/data/definitions/89.html

JVN Vulnerability Information

Cisco Identity Services Engine における SQL インジェクションの脆弱性

Title	Cisco Identity Services Engine における SQL インジェクションの脆弱性
Summary	Cisco Identity Services Engine (ISE) には、SQL インジェクションの脆弱性が存在します。
Possible impacts	情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 17, 2019, midnight
Registration Date	July 30, 2019, 12:29 p.m.
Last Update	July 30, 2019, 12:29 p.m.

Affected System

シスコシステムズ

Cisco Identity Services Engine 2.6.0 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-1942	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1942
National Vulnerability Database (NVD)
2	CVE-2019-1942	https://nvd.nist.gov/vuln/detail/CVE-2019-1942

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-89	https://jvndb.jvn.jp/ja/cwe/CWE-89.html

ベンダー情報

No	Name	URL
Cisco Security Advisory
1	cisco-sa-20190717-ise-sql-inject	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-ise-sql-inject

Change Log

No	Changed Details	Date of change
1	[2019年07月30日] 掲載	July 30, 2019, 12:29 p.m.