TI-2020-02745 Aliases CVE-2020-3184 GHSA-xfhc-xhx2-ffp9

Cisco Prime Collaboration Provisioning Software SQL Injection Vulnerability

LOW 33CWE-89Published 2020-05-22 · Updated 2024-11-15

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-89.

Summary

A vulnerability in the web-based management interface of Cisco Prime Collaboration Provisioning Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. The vulnerability exists because the web-based management interface improperly validates user input for specific SQL queries. An attacker could exploit this vulnerability by authenticating to the application with valid administrative credentials and sending malicious requests to an affected system. A successful exploit could allow the attacker to view information that they are not authorized to view, make changes to the system that they are not authorized to make, or delete information from the database that they are not authorized to delete.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00944 61st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Cisco	Cisco Prime Collaboration Provisioning	all versions	—	No fix listed	CNA

Cisco Prime Collaboration Provisioning VendorCisco Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:cisco:prime_collaboration_provisioning::::::::	before 12.6	Vulnerable	Cisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:12.6:-::::::	12.6	Vulnerable	Cisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:12.6:service_update1::::::	12.6 service_update1	Vulnerable	Cisco

cpe:2.3:a:cisco:prime_collaboration_provisioning:*:*:*:*:*:*:*:* Versions before 12.6 Vulnerable ·Cisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:12.6:-:*:*:*:*:*:* Versions 12.6 Vulnerable ·Cisco
cpe:2.3:a:cisco:prime_collaboration_provisioning:12.6:service_update1:*:*:*:*:*:* Versions 12.6 service_update1 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2020-3184
2026-10-03 Alias added: GHSA-xfhc-xhx2-ffp9

References

Advisory 1

20200520 Cisco Prime Collaboration Provisioning Software SQL Injection Vulnerability

TI-2017-04381 Access control flaw in Cisco Prime Collaboration Provisioning CVSS 3.0CRITICAL 9.8
TI-2018-00279 SQL injection in Cisco Prime Collaboration Provisioning unknown CVSS 3.0CRITICAL 9.8
TI-2018-00280 Improper authentication in Cisco Prime Collaboration Provisioning unknown CVSS 3.0CRITICAL 9.8
TI-2018-00278 Credentials management flaw in Cisco Prime Collaboration Provisioning unknown CVSS 3.0CRITICAL 9.8
TI-2018-00277 Credentials management flaw in Cisco Prime Collaboration Provisioning unknown CVSS 3.0CRITICAL 9.8
TI-2016-01305 Cisco Prime Collaboration Provisioning 10.6 SP2 (aka 10.6.0.10602) mishandles LDAP… CVSS 3.0CRITICAL 9.8

See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences