A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, low-privileged, remote attacker to conduct a blind SQL injection attack.
This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected API. A successful exploit could allow the attacker to view data in some database tables on an affected device.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Cisco |
|
No data.
No data.
References
History
Fri, 18 Jul 2025 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Wed, 16 Jul 2025 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A vulnerability in a subset of REST APIs of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow an authenticated, low-privileged, remote attacker to conduct a blind SQL injection attack. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted request to an affected API. A successful exploit could allow the attacker to view data in some database tables on an affected device. | |
| Title | Cisco Evolved Programmable Network Manager and Cisco Prime Infrastructure Blind SQL Injection Vulnerability | |
| Weaknesses | CWE-89 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: cisco
Published: 2025-07-16T16:16:28.878Z
Updated: 2025-07-18T14:30:51.552Z
Reserved: 2024-10-10T19:15:13.245Z
Link: CVE-2025-20272
Vulnrichment
Updated: 2025-07-18T14:30:48.548Z
NVD
Status : Awaiting Analysis
Published: 2025-07-16T17:15:28.613
Modified: 2025-07-17T21:15:50.197
Link: CVE-2025-20272
Redhat
No data.