CVE-2018-15403: Multiple Cisco Unified Communications Products Open Redirect Vulnerability
First published: Fri Oct 05 2018(Updated: )
A vulnerability in the web interface of Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an authenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by crafting an HTTP request that causes the web interface to redirect a request to a specific malicious URL. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Unified Communications Manager | =10.5\(2.10000.5\) | |
| Cisco Unified Communications Manager | =11.0\(1.10000.10\) | |
| Cisco Unified Communications Manager | =11.5\(1.10000.6\) | |
| Cisco Unified Communications Manager | =12.0\(1.10000.10\) | |
| Cisco Unity Connection | =9.1\(1\)es23 | |
| Cisco Unified Communications Manager IM and Presence Service | =10.5\(1\) | |
| Cisco Unified Communications Manager IM and Presence Service | =10.5\(2\) | |
| Cisco Unified Communications Manager IM and Presence Service | =12.0\(1\) | |
| Cisco Unified Communications Manager IM and Presence Service | =12.5\(1\) | |
| Cisco Emergency Responder | =11.5\(4.59000.1\) | |
| Cisco Emergency Responder | =12.0\(1.40000.3\) | |
| Cisco Emergency Responder | =12.5\(0.98000.110\) |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2018-15403?
CVE-2018-15403 is a vulnerability in the web interface of Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection that could allow an authenticated, remote attacker to redirect a user to a malicious web page.
How severe is CVE-2018-15403?
CVE-2018-15403 has a severity rating of 5.4 out of 10.
Which software is affected by CVE-2018-15403?
Cisco Unified Communications Manager versions 10.5, 11.0, 11.5, and 12.0, Cisco Unity Connection version 9.1, and Cisco Unified Communications Manager IM & Presence Service versions 10.5, 10.5, 12.0, and 12.5, as well as Cisco Emergency Responder versions 11.5, 12.0, and 12.5 are affected by CVE-2018-15403.
How can an attacker exploit CVE-2018-15403?
An authenticated attacker can exploit CVE-2018-15403 to redirect a user to a malicious web page.
Are there any references related to CVE-2018-15403?
Yes, you can find more information about CVE-2018-15403 at the following references: http://www.securitytracker.com/id/1041780, http://www.securitytracker.com/id/1041789, and https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-er-ucm-redirect.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/weakness
- agent/title
- agent/references
- agent/tags
- agent/event
- agent/description
- agent/first-publish-date
- vendor/cisco
- canonical/cisco unified communications manager
- version/cisco unified communications manager/10.5\(2.10000.5\)
- version/cisco unified communications manager/11.0\(1.10000.10\)
- version/cisco unified communications manager/11.5\(1.10000.6\)
- version/cisco unified communications manager/12.0\(1.10000.10\)
- canonical/cisco unity connection
- version/cisco unity connection/9.1\(1\)es23
- canonical/cisco unified communications manager im and presence service
- version/cisco unified communications manager im and presence service/10.5\(1\)
- version/cisco unified communications manager im and presence service/10.5\(2\)
- version/cisco unified communications manager im and presence service/12.0\(1\)
- version/cisco unified communications manager im and presence service/12.5\(1\)
- canonical/cisco emergency responder
- version/cisco emergency responder/11.5\(4.59000.1\)
- version/cisco emergency responder/12.0\(1.40000.3\)
- version/cisco emergency responder/12.5\(0.98000.110\)