CVE-2018-15447

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability in the web framework code of Cisco Integrated Management Controller (IMC) Supervisor could allow an unauthenticated, remote attacker to execute arbitrary SQL queries. The vulnerability is due to a lack of proper validation of user-supplied input in SQL queries. An attacker could exploit this vulnerability by sending crafted URLs that contain malicious SQL statements to the affected application.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

VendorProductVersions
CiscoCisco Integrated Management Controller (IMC) Supervisorn/a

References

Timeline

Published
Nov 8, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-154487.5A vulnerability in the user management functions of Cisco Registered Envelope Service could allow an unauthenticated, remote attacker to disCVE-2018-154496.5A vulnerability in the web-based management interface of Cisco Video Surveillance Media Server could allow an unauthenticated, remote attackCVE-2018-15457.5IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) uses weaker than expected cryptographic algorithms that could allow an attackeCVE-2018-154506.5A vulnerability in the web-based UI of Cisco Prime Collaboration Assurance could allow an authenticated, remote attacker to overwrite files CVE-2018-154515.4A vulnerability in the web-based management interface of Cisco Prime Service Catalog could allow an authenticated, remote attacker to conducCVE-2018-154526.7A vulnerability in the DLL loading component of Cisco Advanced Malware Protection (AMP) for Endpoints on Windows could allow an authenticateCVE-2018-154538.6A vulnerability in the Secure/Multipurpose Internet Mail Extensions (S/MIME) Decryption and Verification or S/MIME Public Key Harvesting feaCVE-2018-154548.6A vulnerability in the Session Initiation Protocol (SIP) inspection engine of Cisco Adaptive Security Appliance (ASA) Software and Cisco FirCVE-2018-154556.1A vulnerability in the logging component of Cisco Identity Services Engine could allow an unauthenticated, remote attacker to conduct cross-CVE-2018-154564.9A vulnerability in the Admin Portal of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to view saved passCVE-2018-154576.1A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an unauthenticated, remote attacker to conduCVE-2018-154587.5A vulnerability in the Shell Access Filter feature of Cisco Firepower Management Center (FMC), when used in conjunction with remote authenti
CVE-2018-15447: Critical severity, CVSS 9.8 | Vulnix