{"api_version":"1","generated_at":"2026-07-23T14:50:50+00:00","cve":"CVE-2013-5525","urls":{"html":"https://cve.report/CVE-2013-5525","api":"https://cve.report/api/cve/CVE-2013-5525.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2013-5525","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2013-5525"},"summary":{"title":"CVE-2013-5525","description":"SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCug90502.","state":"PUBLISHED","assigner":"cisco","published_at":"2013-10-10 10:55:06","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-89","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.5","severity":"","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://osvdb.org/98167","name":"http://osvdb.org/98167","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=31160","name":"http://tools.cisco.com/security/center/viewAlert.x?alertId=31160","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Alert Details - Security Center - Cisco Systems","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id/1029156","name":"http://www.securitytracker.com/id/1029156","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Cisco Identity Services Engine Input Validation Flaw in Web Framework Lets Remote Authenticated Users Inject SQL Commands - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/55098","name":"http://secunia.com/advisories/55098","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA55098 - Cisco Identity Services Engine (ISE) Unspecified SQL Injection Vulnerability - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5525","name":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5525","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Cisco Security Notice: Cisco Identity Services Engine Blind SQL Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/87723","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/87723","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-5525","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-5525","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2013","cve_id":"5525","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_software","cpe6":"1.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"5525","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_software","cpe6":"1.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"5525","vulnerable":"1","versionEndIncluding":"1.2","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"cisco","cpe5":"identity_services_engine_software","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T17:15:20.883Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"cisco-ise-cve20135525-sql-injection(87723)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/87723"},{"name":"1029156","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id/1029156"},{"name":"55098","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/55098"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=31160"},{"name":"20131007 Cisco Identity Services Engine Blind SQL Injection Vulnerability","tags":["vendor-advisory","x_refsource_CISCO","x_transferred"],"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5525"},{"name":"98167","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/98167"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2013-10-07T00:00:00.000Z","descriptions":[{"lang":"en","value":"SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCug90502."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"d1c1063e-7a18-46af-9102-31f8928bc633","shortName":"cisco"},"references":[{"name":"cisco-ise-cve20135525-sql-injection(87723)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/87723"},{"name":"1029156","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id/1029156"},{"name":"55098","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/55098"},{"tags":["x_refsource_CONFIRM"],"url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=31160"},{"name":"20131007 Cisco Identity Services Engine Blind SQL Injection Vulnerability","tags":["vendor-advisory","x_refsource_CISCO"],"url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5525"},{"name":"98167","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/98167"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"psirt@cisco.com","ID":"CVE-2013-5525","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCug90502."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"cisco-ise-cve20135525-sql-injection(87723)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/87723"},{"name":"1029156","refsource":"SECTRACK","url":"http://www.securitytracker.com/id/1029156"},{"name":"55098","refsource":"SECUNIA","url":"http://secunia.com/advisories/55098"},{"name":"http://tools.cisco.com/security/center/viewAlert.x?alertId=31160","refsource":"CONFIRM","url":"http://tools.cisco.com/security/center/viewAlert.x?alertId=31160"},{"name":"20131007 Cisco Identity Services Engine Blind SQL Injection Vulnerability","refsource":"CISCO","url":"http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2013-5525"},{"name":"98167","refsource":"OSVDB","url":"http://osvdb.org/98167"}]}}}},"cveMetadata":{"assignerOrgId":"d1c1063e-7a18-46af-9102-31f8928bc633","assignerShortName":"cisco","cveId":"CVE-2013-5525","datePublished":"2013-10-10T10:00:00.000Z","dateReserved":"2013-08-22T00:00:00.000Z","dateUpdated":"2024-08-06T17:15:20.883Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2013-10-10 10:55:06","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-89","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:P/I:P/A:P","baseScore":6.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_software:*:*:*:*:*:*:*:*","versionEndIncluding":"1.2","matchCriteriaId":"63BC1BB0-33FB-4CBC-99AD-E9E6593B2A11"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_software:1.0:*:*:*:*:*:*:*","matchCriteriaId":"CA49BB84-9E6B-4510-B2DF-178C2E6C0CBE"},{"vulnerable":true,"criteria":"cpe:2.3:a:cisco:identity_services_engine_software:1.1:*:*:*:*:*:*:*","matchCriteriaId":"50CE032F-3BD1-462D-B2DD-4088EA7CE037"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2013","CveId":"5525","Ordinal":"1","Title":"CVE-2013-5525","CVE":"CVE-2013-5525","Year":"2013"},"notes":[{"CveYear":"2013","CveId":"5525","Ordinal":"1","NoteData":"SQL injection vulnerability in the web framework in Cisco Identity Services Engine (ISE) 1.2 and earlier allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCug90502.","Type":"Description","Title":"CVE-2013-5525"},{"CveYear":"2013","CveId":"5525","Ordinal":"2","NoteData":"2013-10-10","Type":"Other","Title":"Published"},{"CveYear":"2013","CveId":"5525","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}