CVE-2017-6754 (CNNVD-201708-246)
中文标题:
Cisco Smart Net Total Care Software Collector Appliance SQL注入漏洞
英文标题:
A vulnerability in the web-based management interface of the Cisco Smart Net Total Care (SNTC) Softw...
漏洞描述
中文描述:
Cisco Smart Net Total Care (SNTC) Software Collector Appliance是美国思科（Cisco）公司的一款智能网络保护服务中的软件映像采集设备。 Cisco SNTC Software Collector Appliance 3.11版本中的基于Web的管理界面存在SQL注入漏洞，该漏洞源于程序没有充分的对用户提交的字段执行充分的输入验证。远程攻击者可通过提交特制的URL利用该漏洞确定受影响软件的SQL数据库中的值是否存在。
英文描述:
A vulnerability in the web-based management interface of the Cisco Smart Net Total Care (SNTC) Software Collector Appliance 3.11 could allow an authenticated, remote attacker to perform a read-only, blind SQL injection attack, which could allow the attacker to compromise the confidentiality of the system through SQL timing attacks. The vulnerability is due to insufficient input validation of certain user-supplied fields that are subsequently used by the affected software to build SQL queries. An attacker could exploit this vulnerability by submitting crafted URLs, which are designed to exploit the vulnerability, to the affected software. To execute an attack successfully, the attacker would need to submit a number of requests to the affected software. A successful exploit could allow the attacker to determine the presence of values in the SQL database of the affected software. Cisco Bug IDs: CSCvf07617.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| cisco | smart_net_total_care_collector_appliance | 3.11 | - | - |
cpe:2.3:a:cisco:smart_net_total_care_collector_appliance:3.11:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2017-6754 |
2025-11-11 15:19:31 | 2025-11-11 07:34:51 |
| NVD | nvd_CVE-2017-6754 |
2025-11-11 14:55:30 | 2025-11-11 07:43:28 |
| CNNVD | cnnvd_CNNVD-201708-246 |
2025-11-11 15:09:52 | 2025-11-11 07:53:13 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> SQL注入
- cnnvd_id: 未提取 -> CNNVD-201708-246
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- cvss_score: 未提取 -> 6.5
- cvss_vector: NOT_EXTRACTED -> CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- cvss_version: NOT_EXTRACTED -> 3.0
- affected_products_count: 0 -> 1
- data_sources: ['cve'] -> ['cve', 'nvd']