CVE-2011-2546 - Vulnerability Details - OpenCVE

SQL injection vulnerability in the web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCtq65669.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00296.

Key SSVC decision points have not yet been added.

Vendors	Products
Cisco	Sa500 Software Sa520 Sa520w Sa540

Configuration 1 [-]

AND

OR	cpe:2.3:a:cisco:sa500_software::::::::
	cpe:2.3:a:cisco:sa500_software:1.0.14:::::::*
	cpe:2.3:a:cisco:sa500_software:1.0.15:::::::*
	cpe:2.3:a:cisco:sa500_software:1.0.17:::::::*
	cpe:2.3:a:cisco:sa500_software:1.0.39:::::::*
	cpe:2.3:a:cisco:sa500_software:1.1.21:::::::*
	cpe:2.3:a:cisco:sa500_software:1.1.42:::::::*
	cpe:2.3:a:cisco:sa500_software:1.1.65:::::::*

OR	cpe:2.3:h:cisco:sa520::::::::
	cpe:2.3:h:cisco:sa520w::::::::
	cpe:2.3:h:cisco:sa540::::::::

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
http://secunia.com/advisories/45355
http://securitytracker.com/id?1025810
http://www.cisco.com/en/US/products/products_security_advisory09186a0080b8915e.shtml
http://www.securityfocus.com/bid/48812
https://exchange.xforce.ibmcloud.com/vulnerabilities/68737

History

No history.

MITRE

Status: PUBLISHED

Assigner: cisco

Published: 2011-07-28T22:00:00

Updated: 2024-08-06T23:08:22.701Z

Reserved: 2011-06-27T00:00:00

Link: CVE-2011-2546

Vulnrichment

No data.

NVD

Status : Deferred

Published: 2011-07-28T22:55:02.093

Modified: 2025-04-11T00:51:21.963

Link: CVE-2011-2546

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2011-07-20T00:00:00", "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in the web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCtq65669."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-28T12:57:01", "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "shortName": "cisco"}, "references": [{"name": "45355", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/45355"}, {"name": "20110720 Cisco SA 500 Series Security Appliances Web Management Interface Vulnerabilities", "tags": ["vendor-advisory", "x_refsource_CISCO"], "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b8915e.shtml"}, {"name": "1025810", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://securitytracker.com/id?1025810"}, {"name": "cisco-sa500-login-sql-injection(68737)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68737"}, {"name": "48812", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/48812"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@cisco.com", "ID": "CVE-2011-2546", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "SQL injection vulnerability in the web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCtq65669."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "45355", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/45355"}, {"name": "20110720 Cisco SA 500 Series Security Appliances Web Management Interface Vulnerabilities", "refsource": "CISCO", "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b8915e.shtml"}, {"name": "1025810", "refsource": "SECTRACK", "url": "http://securitytracker.com/id?1025810"}, {"name": "cisco-sa500-login-sql-injection(68737)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68737"}, {"name": "48812", "refsource": "BID", "url": "http://www.securityfocus.com/bid/48812"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T23:08:22.701Z"}, "title": "CVE Program Container", "references": [{"name": "45355", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/45355"}, {"name": "20110720 Cisco SA 500 Series Security Appliances Web Management Interface Vulnerabilities", "tags": ["vendor-advisory", "x_refsource_CISCO", "x_transferred"], "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b8915e.shtml"}, {"name": "1025810", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://securitytracker.com/id?1025810"}, {"name": "cisco-sa500-login-sql-injection(68737)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68737"}, {"name": "48812", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/48812"}]}]}, "cveMetadata": {"assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633", "assignerShortName": "cisco", "cveId": "CVE-2011-2546", "datePublished": "2011-07-28T22:00:00", "dateReserved": "2011-06-27T00:00:00", "dateUpdated": "2024-08-06T23:08:22.701Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cisco:sa500_software:*:*:*:*:*:*:*:*", "matchCriteriaId": "F34CEB78-9F68-4BF7-BB70-7AF03524CA9D", "versionEndIncluding": "2.1.18", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:sa500_software:1.0.14:*:*:*:*:*:*:*", "matchCriteriaId": "988B2905-DE56-417F-BDFC-26C3120F4FE9", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:sa500_software:1.0.15:*:*:*:*:*:*:*", "matchCriteriaId": "0B1DCFEE-D2CA-46EC-B92B-7BC6D84A863F", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:sa500_software:1.0.17:*:*:*:*:*:*:*", "matchCriteriaId": "C6969B8E-BA94-4E5C-8864-886EC7DB5568", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:sa500_software:1.0.39:*:*:*:*:*:*:*", "matchCriteriaId": "3F3EFD6F-BCA3-4578-ACB7-CDA48C66F8A8", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:sa500_software:1.1.21:*:*:*:*:*:*:*", "matchCriteriaId": "C8D0F427-03DB-4B77-AD44-2CF30A3A8468", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:sa500_software:1.1.42:*:*:*:*:*:*:*", "matchCriteriaId": "9D1CC976-BE22-4C5B-A877-ED78544C2730", "vulnerable": true}, {"criteria": "cpe:2.3:a:cisco:sa500_software:1.1.65:*:*:*:*:*:*:*", "matchCriteriaId": "CE089465-47D4-48EC-878A-B045E78A6D7A", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:cisco:sa520:*:*:*:*:*:*:*:*", "matchCriteriaId": "41EA22A9-7330-473D-A8F6-625EACF21B35", "vulnerable": true}, {"criteria": "cpe:2.3:h:cisco:sa520w:*:*:*:*:*:*:*:*", "matchCriteriaId": "5C7A7463-BCAC-4DD8-920A-2D3134D3B579", "vulnerable": true}, {"criteria": "cpe:2.3:h:cisco:sa540:*:*:*:*:*:*:*:*", "matchCriteriaId": "86F2ED99-EB36-4FB6-8404-BF0DDD2B2AEA", "vulnerable": true}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SQL injection vulnerability in the web-based management interface on Cisco SA 500 series security appliances with software before 2.1.19 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCtq65669."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n SQL en la interfaz de gesti\u00f3n basada en la web de aplicativos de seguridad Cisco SA 500 con el software anterior a v2.1.19 permite a atacantes remotos ejecutar comandos SQL a trav\u00e9s de vectores no especificados, tambi\u00e9n conocido como Bug ID CSCtq65669."}], "id": "CVE-2011-2546", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2011-07-28T22:55:02.093", "references": [{"source": "psirt@cisco.com", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/45355"}, {"source": "psirt@cisco.com", "url": "http://securitytracker.com/id?1025810"}, {"source": "psirt@cisco.com", "tags": ["Vendor Advisory"], "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b8915e.shtml"}, {"source": "psirt@cisco.com", "url": "http://www.securityfocus.com/bid/48812"}, {"source": "psirt@cisco.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68737"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://secunia.com/advisories/45355"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securitytracker.com/id?1025810"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://www.cisco.com/en/US/products/products_security_advisory09186a0080b8915e.shtml"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/48812"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/68737"}], "sourceIdentifier": "psirt@cisco.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}]}