SQL injection in Cisco Vision Dynamic Signage Director - CVE-2020-3450
Published: July 21, 2020
Vulnerability identifier: #VU31721
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-3450
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data in the web-based management. A remote administrator can send a specially crafted request to the affected application and obtain data that is stored in the underlying database, including hashed user credentials.
Affected software
Cisco Vision Dynamic Signage Director
How to mitigate CVE-2020-3450
Install update from vendor's website.
Cisco Vision Dynamic Signage Director - update to 6.2.0 SP5