Summary

A REST API endpoint and the web-based management interface of Cisco Nexus Dashboard Fabric Controller fail to neutralize SQL in user input. An authenticated, remote attacker with only read only privileges can execute arbitrary SQL against the internal database.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H — 8.8 High.

Details

User-supplied values reach a SQL query without parameterization, so a low-trust (read-only) account can read, modify, or delete arbitrary data.

Impact

Read, modification, or deletion of arbitrary data in the NDFC database from a read-only account.

Remediation

  • Upgrade to a fixed Cisco NDFC release per the Cisco advisory.

References