Actu
Vigil@nce - Cisco Prime Infrastructure: code execution via Log File
May 2016 by Vigil@nce
This bulletin was written by Vigil@nce : https://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An authenticated attacker can inject malicious data in the log
file of Cisco Prime Infrastructure, in order to run code.
Impacted products: Prime Infrastructure.
Severity: 2/4.
Creation date: 03/03/2016.
DESCRIPTION OF THE VULNERABILITY
The Cisco Prime Infrastructure product logs HTTP queries.
However, special patterns can lead to code execution when these
logs are displayed.
An authenticated attacker can therefore inject malicious data in
the log file of Cisco Prime Infrastructure, in order to run code.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
https://vigilance.fr/vulnerability/Cisco-Prime-Infrastructure-code-execution-via-Log-File-19085
