Cisco Unified Operations Manager Multiple SQL Injection Vulnerabilities

Bugtraq ID:	47898
Class:	Input Validation Error
CVE:	CVE-2011-0960
Remote:	Yes
Local:	No
Published:	May 18 2011 12:00AM
Updated:	May 18 2011 12:00AM
Credit:	Sense of Security
Vulnerable:	Cisco Cisco Unified Operations Manager (CUOM) 2.0.3 Cisco Cisco Unified Operations Manager (CUOM) 2.0.2 Cisco Cisco Unified Operations Manager (CUOM) 2.0.1 Cisco Cisco Unified Operations Manager (CUOM) 8.5 Cisco Cisco Unified Operations Manager (CUOM) 8.0 Cisco Cisco Unified Operations Manager (CUOM) 2.3 Cisco Cisco Unified Operations Manager (CUOM) 2.2 Cisco Cisco Unified Operations Manager (CUOM) 2.1 SP1 Cisco Cisco Unified Operations Manager (CUOM) 2.1
Not Vulnerable:	Cisco Cisco Unified Operations Manager (CUOM) 8.6

Cisco Unified Operations Manager Multiple SQL Injection Vulnerabilities

Cisco Unified Operations Manager is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an authenticated attacker to compromise the affected device, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue is tracked by Cisco Bug ID CSCtn61716.

Cisco Unified Operations Manager Multiple SQL Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

Cisco Unified Operations Manager Multiple SQL Injection Vulnerabilities

Solution:
Vendor updates are available. Please see the references for more information.

Cisco Unified Operations Manager Multiple SQL Injection Vulnerabilities

References:

• Cisco Homepage (Cisco)
  
• Cisco Unified Operations Manager Multiple Vulnerabilities - SOS-11-006 (Sense of Security)
  
• Cisco Unified Operations Manager Multiple Vulnerabilities - SOS-11-006 (Sense of Security)
  
• Cisco Unified Operations Manager SQL Injection Vulnerability (Cisco)