{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:cisco:evolved_programmable_network_manager:2.0\\(4.0.45b\\):*:*:*:*:*:*:*",
                     matchCriteriaId: "2B1F8D62-E893-4AF6-8195-DFB7810AA6AE",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:evolved_programmable_network_manager:2.0\\(4.0.45d\\):*:*:*:*:*:*:*",
                     matchCriteriaId: "408D3C56-EB92-4013-860B-C60AF0D03D39",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:evolved_programmable_network_manager:2.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "76E28AD8-1C7F-4003-B27C-1F87B988FE03",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:3.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "27F4F1D6-82DA-4675-B734-D9C5371E6654",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:3.1\\(0.128\\):*:*:*:*:*:*:*",
                     matchCriteriaId: "4F9CC0D0-08A5-45A0-BF1C-2D3E32D49B3E",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:3.1.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "BBD9A93C-FE79-4323-BBF1-F9B2CD559570",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. More Information: CSCvc24616 CSCvc35363 CSCvc49574. Known Affected Releases: 3.1(1) 2.0(4.0.45B).",
      },
      {
         lang: "es",
         value: "Una vulnerabilidad en la interfaz de administración basada en web de Prime Infrastructure (PI) y Evolved Programmable Network Manager (EPNM) de Cisco, podría permitir a un atacante remoto no autenticado conducir un ataque de tipo cross-site scripting (XSS) reflejado contra un usuario de la interfaz de administración basada en web en un dispositivo afectado. Más información: CSCvc24616 CSCvc35363 CSCvc49574. Versiones Afectadas Conocidas: 3.1(1) 2.0(4.0.45B).",
      },
   ],
   id: "CVE-2017-6699",
   lastModified: "2025-04-20T01:37:25.860",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.1,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "NONE",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 2.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-07-04T00:29:00.290",
   references: [
      {
         source: "psirt@cisco.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/99221",
      },
      {
         source: "psirt@cisco.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securitytracker.com/id/1038751",
      },
      {
         source: "psirt@cisco.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-piepnm3",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/99221",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securitytracker.com/id/1038751",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-piepnm3",
      },
   ],
   sourceIdentifier: "psirt@cisco.com",
   vulnStatus: "Deferred",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:cisco:evolved_programmable_network_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "6F09A4CD-6339-48F6-9408-3E5949316FE9",
                     versionEndExcluding: "3.0.1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:network_level_service:3.0\\(0.0.83b\\):*:*:*:*:*:*:*",
                     matchCriteriaId: "FCC948E4-B186-4FDC-84EB-B4F30F902FA1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "67CF7487-D071-4DE6-8E87-B379B24D7BBD",
                     versionEndExcluding: "3.4.1",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system.",
      },
      {
         lang: "es",
         value: "Una vulnerabilidad enweb-based management interface de Cisco Prime Infrastructure (PI) y Cisco Evolved Programmable Network (EPN) Manager podría permitir que un atacante remoto autenticado ejecute código con privilegios de nivel raíz en el sistema operativo subyacente. Esta vulnerabilidad existe porque el programa valida incorrectamente la entrada proporcionada por el usuario. Un atacante podría aprovechar esta vulnerabilidad al cargar un archivo malicioso en la interfaz web administrativa. Un aprovechamiento exitoso podría permitir al atacante ejecutar código con privilegios de nivel raíz en el sistema operativo subyacente.",
      },
   ],
   id: "CVE-2019-1821",
   lastModified: "2024-11-21T04:37:28.080",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "COMPLETE",
               baseScore: 10,
               confidentialityImpact: "COMPLETE",
               integrityImpact: "COMPLETE",
               vectorString: "AV:N/AC:L/Au:N/C:C/I:C/A:C",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 10,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "psirt@cisco.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9.8,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2019-05-16T01:29:00.483",
   references: [
      {
         source: "psirt@cisco.com",
         url: "http://packetstormsecurity.com/files/153350/Cisco-Prime-Infrastructure-Health-Monitor-TarArchive-Directory-Traversal.html",
      },
      {
         source: "psirt@cisco.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/108339",
      },
      {
         source: "psirt@cisco.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-rce",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://packetstormsecurity.com/files/153350/Cisco-Prime-Infrastructure-Health-Monitor-TarArchive-Directory-Traversal.html",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/108339",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-rce",
      },
   ],
   sourceIdentifier: "psirt@cisco.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-20",
            },
         ],
         source: "psirt@cisco.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-20",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:cisco:evolved_programmable_network_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "2AEC9133-19C1-4CC5-A1F4-187D2EF36B40",
                     versionEndExcluding: "7.1.1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "5CC17E6B-D7AB-40D7-AEC5-F5B555AC4D7F",
                     versionEndExcluding: "3.10.4",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:3.10.4:-:*:*:*:*:*:*",
                     matchCriteriaId: "8E76E81B-A235-4A19-AAE4-319CB7840673",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:3.10.4:update_1:*:*:*:*:*:*",
                     matchCriteriaId: "774C7557-0D83-40A9-815C-4E32419A3B6F",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system. This vulnerability is due to improper processing of serialized Java objects by the affected application. An attacker could exploit this vulnerability by uploading a document containing malicious serialized Java objects to be processed by the affected application. A successful exploit could allow the attacker to cause the application to execute arbitrary commands.",
      },
      {
         lang: "es",
         value: "Una vulnerabilidad en la interfaz de administración basada en web de Cisco Prime Infrastructure podría permitir que un atacante remoto autenticado ejecute comandos arbitrarios en el sistema operativo subyacente. Esta vulnerabilidad se debe al procesamiento inadecuado de objetos Java serializados por parte de la aplicación afectada. Un atacante podría aprovechar esta vulnerabilidad cargando un documento que contenga objetos Java serializados maliciosos para que los procese la aplicación afectada. Una explotación exitosa podría permitir al atacante hacer que la aplicación ejecute comandos arbitrarios.",
      },
   ],
   id: "CVE-2023-20258",
   lastModified: "2024-11-21T07:41:00.830",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "HIGH",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N",
               version: "3.1",
            },
            exploitabilityScore: 1.2,
            impactScore: 5.2,
            source: "psirt@cisco.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.2,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "HIGH",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.2,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2024-01-17T17:15:10.147",
   references: [
      {
         source: "psirt@cisco.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-wkZJeyeq",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-pi-epnm-wkZJeyeq",
      },
   ],
   sourceIdentifier: "psirt@cisco.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "NVD-CWE-noinfo",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "5C53419F-962E-49CC-99D0-29229587B247",
                     versionEndExcluding: "3.4.2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "F41CF51E-27EF-49FE-8534-B829B5D8566C",
                     versionEndExcluding: "3.5.1",
                     versionStartIncluding: "3.5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:3.6:*:*:*:*:*:*:*",
                     matchCriteriaId: "C05391BE-19CB-4E9A-956C-BA747E95D0EE",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:cisco:evolved_programmable_network_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "1B6286E9-2465-43F3-B56C-6B8433022F70",
                     versionEndExcluding: "3.0.2",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A vulnerability in the REST API of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network Manager (EPNM) could allow an unauthenticated remote attacker to execute arbitrary code with root privileges on the underlying operating system. The vulnerability is due to insufficient input validation during the initial High Availability (HA) configuration and registration process of an affected device. An attacker could exploit this vulnerability by uploading a malicious file during the HA registration period. A successful exploit could allow the attacker to execute arbitrary code with root-level privileges on the underlying operating system. Note: This vulnerability can only be exploited during the HA registration period. See the Details section for more information.",
      },
      {
         lang: "es",
         value: "Una vulnerabilidad en la API REST de Cisco Prime Infrastructure (PI) y Cisco Evolved Programmable Network Manager (EPNM), podría permitir a un atacante remoto no autenticado ejecutar código arbitrario con privilegios root en el sistema operativo subyacente. La vulnerabilidad es debido a una comprobación de entrada insuficiente durante la configuración inicial de alta disponibilidad (HA) y el proceso de registro de un dispositivo afectado. Un atacante podría explotar esta vulnerabilidad al cargar un archivo malicioso durante el período de registro de HA. Una explotación con éxito podría permitir al atacante ejecutar código arbitrario con privilegios de nivel root en el sistema operativo subyacente. Nota: Esta vulnerabilidad solo puede ser explotada durante el período de registro de HA. Vea la sección Detalles para más información.",
      },
   ],
   id: "CVE-2019-15958",
   lastModified: "2024-11-21T04:29:49.350",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "COMPLETE",
               baseScore: 10,
               confidentialityImpact: "COMPLETE",
               integrityImpact: "COMPLETE",
               vectorString: "AV:N/AC:L/Au:N/C:C/I:C/A:C",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 10,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "HIGH",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.1,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 2.2,
            impactScore: 5.9,
            source: "psirt@cisco.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9.8,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2019-11-26T03:15:11.503",
   references: [
      {
         source: "psirt@cisco.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-pi-epn-codex",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-pi-epn-codex",
      },
   ],
   sourceIdentifier: "psirt@cisco.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-20",
            },
         ],
         source: "psirt@cisco.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-20",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:cisco:evolved_programmable_network_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "929F2586-6A41-4560-AD9B-E96067766280",
                     versionEndExcluding: "7.0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "27E0CC45-5CFF-4ABC-9E69-6B7119B697C2",
                     versionEndExcluding: "3.10.3",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against a user of the interface on an affected device. This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker would need to have valid credentials to access the web-based management interface of the affected device.",
      },
   ],
   id: "CVE-2023-20069",
   lastModified: "2024-11-21T07:40:28.840",
   metrics: {
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 5.4,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "LOW",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.3,
            impactScore: 2.7,
            source: "psirt@cisco.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 5.4,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "LOW",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.3,
            impactScore: 2.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2023-03-03T16:15:10.167",
   references: [
      {
         source: "psirt@cisco.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cisco-pi-epnm-xss-mZShH2J",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cisco-pi-epnm-xss-mZShH2J",
      },
   ],
   sourceIdentifier: "psirt@cisco.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "psirt@cisco.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:cisco:evolved_programmable_network_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "6F09A4CD-6339-48F6-9408-3E5949316FE9",
                     versionEndExcluding: "3.0.1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:network_level_service:3.0\\(0.0.83b\\):*:*:*:*:*:*:*",
                     matchCriteriaId: "FCC948E4-B186-4FDC-84EB-B4F30F902FA1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "67CF7487-D071-4DE6-8E87-B379B24D7BBD",
                     versionEndExcluding: "3.4.1",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute arbitrary SQL queries. This vulnerability exist because the software improperly validates user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending a crafted HTTP request that contains malicious SQL statements to the affected application. A successful exploit could allow the attacker to view or modify entries in some database tables, affecting the integrity of the data.",
      },
      {
         lang: "es",
         value: "Una vulnerabilidad en la web-based management interface de Prime Infrastructure (PI) y  Evolved Programmable Network (EPN) Manager  de Cisco podría permitir que un atacante remoto autenticado ejecutara consultas SQL arbitrarias. Esta vulnerabilidad existe porque el programa verifica incorrectamente la entrada proporcionada por el usuario en las consultas SQL. Un atacante podría aprovechar esta vulnerabilidad enviando una solicitud HTTP diseñada que contenga sentencias SQL  maliciosas a la aplicación afectada. Un aprovechamiento exitoso podría permitir al atacante ver o modificar entradas en algunas tablas de la base de datos, afectando la integridad de los datos.",
      },
   ],
   id: "CVE-2019-1825",
   lastModified: "2024-11-21T04:37:28.623",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "NONE",
               baseScore: 5.5,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:L/Au:S/C:P/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8,
            impactScore: 4.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 8.1,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.2,
            source: "psirt@cisco.com",
            type: "Secondary",
         },
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 8.1,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.2,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2019-05-16T01:29:00.750",
   references: [
      {
         source: "psirt@cisco.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/108337",
      },
      {
         source: "psirt@cisco.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-sqlinject",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/108337",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-sqlinject",
      },
   ],
   sourceIdentifier: "psirt@cisco.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-89",
            },
         ],
         source: "psirt@cisco.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-89",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:cisco:evolved_programmable_network_manager:1.2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "3C057764-0A1B-41A9-A21B-F665480145AD",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:evolved_programmable_network_manager:1.2.1.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "1AE45F94-2372-4CDD-A1E1-A4646F8D85AF",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:evolved_programmable_network_manager:1.2.200:*:*:*:*:*:*:*",
                     matchCriteriaId: "8FD09D59-8557-4559-B0AB-71ECDEC77150",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:evolved_programmable_network_manager:1.2.300:*:*:*:*:*:*:*",
                     matchCriteriaId: "1E49859E-08F7-485D-8EA0-F1B6024B2413",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:evolved_programmable_network_manager:1.2.400:*:*:*:*:*:*:*",
                     matchCriteriaId: "E9A9DA98-C2E5-4CCB-B31B-3E55A0C98FBC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:evolved_programmable_network_manager:1.2.500:*:*:*:*:*:*:*",
                     matchCriteriaId: "2345C38D-1BA0-4A72-AC3E-8BA80FCEF7C6",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:evolved_programmable_network_manager:2.0\\(4.0.45d\\):*:*:*:*:*:*:*",
                     matchCriteriaId: "408D3C56-EB92-4013-860B-C60AF0D03D39",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:evolved_programmable_network_manager:2.0.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "76E28AD8-1C7F-4003-B27C-1F87B988FE03",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:1.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "BA72A91C-0E65-420A-9DBE-3E0853EDB7C5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:1.2.0.103:*:*:*:*:*:*:*",
                     matchCriteriaId: "B257E2F8-30EB-4BCC-8ACF-35DF73107AAC",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:1.2.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "8B48C1E6-7C18-4C6B-B402-9C0E1A931C2C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:1.3:*:*:*:*:*:*:*",
                     matchCriteriaId: "B64A7FCA-1DEA-45B2-9C69-CCDCC848D9B3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:1.3.0.20:*:*:*:*:*:*:*",
                     matchCriteriaId: "E78D776C-AA8C-471D-A0C0-02428FA07A29",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:1.4:*:*:*:*:*:*:*",
                     matchCriteriaId: "9D3206E7-DC91-4861-AD32-46DA82509D5B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:1.4.0.45:*:*:*:*:*:*:*",
                     matchCriteriaId: "1704AC8E-BD7E-4882-8BB3-45B9E2AE0F10",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:1.4.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "9ACB00E7-41E3-4221-8400-A279A75FD355",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:1.4.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "853315C7-01A7-4E83-9CBB-D45F6B5C4664",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:2.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "EB157A80-3A03-4B8D-9B20-C456A953CF7E",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:2.1.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "7678B118-E00C-4B1E-8B40-D3233DE3615C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:2.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "56394A07-6D74-4588-8C05-DE04959F7FC7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:2.2\\(2\\):*:*:*:*:*:*:*",
                     matchCriteriaId: "7830BF63-55ED-4D8B-B380-1E78E338EA2D",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:2.2\\(3\\):*:*:*:*:*:*:*",
                     matchCriteriaId: "D9BCDE33-49E9-4B46-AE31-563F3B6434F5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:3.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "48F3C5A5-6C84-408D-B59A-265F8775C943",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:3.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "27F4F1D6-82DA-4675-B734-D9C5371E6654",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:3.1\\(0.128\\):*:*:*:*:*:*:*",
                     matchCriteriaId: "4F9CC0D0-08A5-45A0-BF1C-2D3E32D49B3E",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:3.1\\(4.0\\):*:*:*:*:*:*:*",
                     matchCriteriaId: "7500DF7B-FD3C-49B3-81C7-55E78B83A1C2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:3.1\\(5.0\\):*:*:*:*:*:*:*",
                     matchCriteriaId: "E5A66318-C59B-4D2C-B63E-5B1E3A61E63C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:3.1.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "BBD9A93C-FE79-4323-BBF1-F9B2CD559570",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:3.2\\(0.0\\):*:*:*:*:*:*:*",
                     matchCriteriaId: "146E4ECF-B903-488C-8644-932FC57F072C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:3.2_base:*:*:*:*:*:*:*",
                     matchCriteriaId: "17B3932F-457E-4620-AC03-70D5729757E3",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A vulnerability in the web-based user interface of Cisco Prime Infrastructure (PI) and Evolved Programmable Network Manager (EPNM) could allow an authenticated, remote attacker read and write access to information stored in the affected system as well as perform remote code execution. The attacker must have valid user credentials. The vulnerability is due to improper handling of XML External Entity (XXE) entries when parsing an XML file. An attacker could exploit this vulnerability by convincing the administrator of an affected system to import a crafted XML file with malicious entries which could allow the attacker to read and write files and execute remote code within the application, aka XML Injection. Cisco Prime Infrastructure software releases 1.1 through 3.1.6 are vulnerable. Cisco EPNM software releases 1.2, 2.0, and 2.1 are vulnerable. Cisco Bug IDs: CSCvc23894 CSCvc49561.",
      },
      {
         lang: "es",
         value: "Una vulnerabilidad en la interfaz de usuario basada en web de Prime Infrastructure (PI) y Evolved Programmable Network Manager (EPNM) de Cisco, podría permitir a un atacante remoto identificado acceder a la información almacenada en el sistema afectado, así como a realizar ejecución de código remota. El atacante necesita tener credenciales de usuario válidas. La vulnerabilidad es debido al control inapropiado de las entradas de tipo XML External Entity (XXE) cuando se analiza un archivo XML. Un atacante podría explotar esta vulnerabilidad mediante el convencimiento del administrador de un sistema afectado para importar un archivo XML especialmente diseñado con entradas maliciosas que podrían permitir al atacante leer y escribir archivos y ejecutar código remoto dentro de la aplicación, también se conoce como Inyección XML. El software Prime Infrastructure en las versiones 1.1 hasta 3.1.6 de Cisco es vulnerable. El software de EPNM en las versiones 1.2, 2.0 y 2.1 de Cisco son vulnerables. IDs de bug de Cisco: CSCvc23894 CSCvc49561.",
      },
   ],
   id: "CVE-2017-6662",
   lastModified: "2025-04-20T01:37:25.860",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "PARTIAL",
               baseScore: 6,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:S/C:P/I:P/A:P",
               version: "2.0",
            },
            exploitabilityScore: 6.8,
            impactScore: 6.4,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 2.1,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-06-26T07:29:00.170",
   references: [
      {
         source: "psirt@cisco.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/99194",
      },
      {
         source: "psirt@cisco.com",
         url: "http://www.securitytracker.com/id/1038750",
      },
      {
         source: "psirt@cisco.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-piepnm1",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/99194",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securitytracker.com/id/1038750",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170621-piepnm1",
      },
   ],
   sourceIdentifier: "psirt@cisco.com",
   vulnStatus: "Deferred",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-20",
            },
         ],
         source: "psirt@cisco.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-611",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:cisco:evolved_programmable_network_manager:2.0\\(4.0.45d\\):*:*:*:*:*:*:*",
                     matchCriteriaId: "408D3C56-EB92-4013-860B-C60AF0D03D39",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:2.2:*:*:*:*:*:*:*",
                     matchCriteriaId: "56394A07-6D74-4588-8C05-DE04959F7FC7",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:2.2\\(3\\):*:*:*:*:*:*:*",
                     matchCriteriaId: "D9BCDE33-49E9-4B46-AE31-563F3B6434F5",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:3.0:*:*:*:*:*:*:*",
                     matchCriteriaId: "48F3C5A5-6C84-408D-B59A-265F8775C943",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:3.1:*:*:*:*:*:*:*",
                     matchCriteriaId: "27F4F1D6-82DA-4675-B734-D9C5371E6654",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:3.1\\(0.128\\):*:*:*:*:*:*:*",
                     matchCriteriaId: "4F9CC0D0-08A5-45A0-BF1C-2D3E32D49B3E",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:3.1\\(4.0\\):*:*:*:*:*:*:*",
                     matchCriteriaId: "7500DF7B-FD3C-49B3-81C7-55E78B83A1C2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:3.1\\(5.0\\):*:*:*:*:*:*:*",
                     matchCriteriaId: "E5A66318-C59B-4D2C-B63E-5B1E3A61E63C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:3.2\\(0.0\\):*:*:*:*:*:*:*",
                     matchCriteriaId: "146E4ECF-B903-488C-8644-932FC57F072C",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A vulnerability in the web interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to access sensitive data. The attacker does not need administrator credentials and could use this information to conduct additional reconnaissance attacks. More Information: CSCvc60031 (Fixed) CSCvc60041 (Fixed) CSCvc60095 (Open) CSCvc60102 (Open). Known Affected Releases: 2.2 2.2(3) 3.0 3.1(0.0) 3.1(0.128) 3.1(4.0) 3.1(5.0) 3.2(0.0) 2.0(4.0.45D).",
      },
      {
         lang: "es",
         value: "Una vulnerabilidad en la interfaz web de Cisco Prime Infrastructure y del administrador Evolved Programmable Network de Cisco (EPN) podría permitir a un atacante remoto autenticado acceder a datos confidenciales. El atacante no necesita credenciales de administrador y podría usar esta información para realizar ataques de reconocimiento adicionales. Más información: CSCvc60031 (fijo) CSCvc60041 (fijo) CSCvc60095 (abierto) CSCvc60102 (abierto). Liberaciones conocidas: 2,2 2,2(3) 3,0 3,1(0,0) 3,1(0,128) 3,1(4,0) 3,1(5,0) 3,2(0,0) 2,0(4,0,45D).",
      },
   ],
   id: "CVE-2017-3884",
   lastModified: "2025-04-20T01:37:25.860",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "NONE",
               baseScore: 4,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:S/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2017-04-07T17:59:00.357",
   references: [
      {
         source: "psirt@cisco.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/97470",
      },
      {
         source: "psirt@cisco.com",
         url: "http://www.securitytracker.com/id/1038189",
      },
      {
         source: "psirt@cisco.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-cpi",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/97470",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://www.securitytracker.com/id/1038189",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170405-cpi",
      },
   ],
   sourceIdentifier: "psirt@cisco.com",
   vulnStatus: "Deferred",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-200",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:cisco:evolved_programmable_network_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "6F09A4CD-6339-48F6-9408-3E5949316FE9",
                     versionEndExcluding: "3.0.1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "A4491F05-D89C-4B35-A051-B36957DD9F68",
                     versionEndExcluding: "3.4",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network (EPN) Manager software could allow an authenticated, remote attacker to download and view files within the application that should be restricted. This vulnerability is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames. An attacker could exploit this vulnerability by using directory traversal techniques to submit a path to a desired file location. A successful exploit could allow the attacker to view application files that may contain sensitive information.",
      },
      {
         lang: "es",
         value: "Una vulnerabilidad en la interfaz de administración web-based del programa Cisco Prime Infrastructure y Cisco Evolved Programmable Network (EPN) podría permitir que un atacante remoto autentificado descargue y vea archivos dentro de la aplicación que deberían estar restringidos. Esta vulnerabilidad se debe a un saneamiento incorrecto de la entrada proporcionada por el usuario en los parámetros de solicitud HTTP que describen los nombres de archivo. Un atacante podría aprovechar esta vulnerabilidad mediante el uso de técnicas de cruce de directorios para enviar una ruta a una ubicación de archivo deseada. Un aprovechamiento exitoso podría permitir al atacante ver archivos de aplicaciones que pueden contener información confidencial.",
      },
   ],
   id: "CVE-2019-1818",
   lastModified: "2024-11-21T04:37:26.773",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "NONE",
               baseScore: 4,
               confidentialityImpact: "PARTIAL",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:S/C:P/I:N/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 3.6,
            source: "psirt@cisco.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.5,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "HIGH",
               integrityImpact: "NONE",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
               version: "3.1",
            },
            exploitabilityScore: 2.8,
            impactScore: 3.6,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2019-05-16T01:29:00.297",
   references: [
      {
         source: "psirt@cisco.com",
         tags: [
            "Broken Link",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/108352",
      },
      {
         source: "psirt@cisco.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-pathtrav-1818",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/108352",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-pathtrav-1818",
      },
   ],
   sourceIdentifier: "psirt@cisco.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-22",
            },
         ],
         source: "psirt@cisco.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-22",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:a:cisco:evolved_programmable_network_manager:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "6F09A4CD-6339-48F6-9408-3E5949316FE9",
                     versionEndExcluding: "3.0.1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:a:cisco:prime_infrastructure:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "67CF7487-D071-4DE6-8E87-B379B24D7BBD",
                     versionEndExcluding: "3.4.1",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system. This vulnerability exist because the software improperly validates user-supplied input. An attacker could exploit this vulnerability by uploading a malicious file to the administrative web interface. A successful exploit could allow the attacker to execute code with root-level privileges on the underlying operating system.",
      },
      {
         lang: "es",
         value: "Una vulnerabilidad en   web-based management interface de Cisco Prime Infrastructure (PI) y Cisco Evolved Programmable Network (EPN) Manager podría permitir que un atacante remoto autenticado ejecute un código con privilegios de nivel raíz en el sistema operativo subyacente. Esta vulnerabilidad existe porque el programa valida incorrectamente la entrada proporcionada por el usuario. Un atacante podría aprovechar esta vulnerabilidad al cargar un archivo malicioso en la interfaz web administrativa. Un aprovechamiento exitoso podría permitir al atacante ejecutar código con privilegios de nivel raíz en el sistema operativo subyacente.",
      },
   ],
   id: "CVE-2019-1822",
   lastModified: "2024-11-21T04:37:28.217",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "SINGLE",
               availabilityImpact: "COMPLETE",
               baseScore: 9,
               confidentialityImpact: "COMPLETE",
               integrityImpact: "COMPLETE",
               vectorString: "AV:N/AC:L/Au:S/C:C/I:C/A:C",
               version: "2.0",
            },
            exploitabilityScore: 8,
            impactScore: 10,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 8.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 5.9,
            source: "psirt@cisco.com",
            type: "Secondary",
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 7.2,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "HIGH",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.2,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2019-05-16T01:29:00.530",
   references: [
      {
         source: "psirt@cisco.com",
         tags: [
            "Broken Link",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/108339",
      },
      {
         source: "psirt@cisco.com",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-rce",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Broken Link",
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/108339",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190515-pi-rce",
      },
   ],
   sourceIdentifier: "psirt@cisco.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-20",
            },
         ],
         source: "psirt@cisco.com",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-20",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}