CVE-2021-1397: Cisco Integrated Management Controller Open Redirect Vulnerability
First published: Thu May 06 2021(Updated: )
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website. This vulnerability is known as an open redirect attack, which is used in phishing attacks to get users to visit malicious sites without their knowledge.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Integrated Management Controller | <3.2\(12.4\) | |
| Cisco UCS Manager | <=4.1\(3b\) | |
| Cisco 5100 Enterprise Network Compute System firmware | <=4.4.2 | |
| Cisco ENCS 5100 | ||
| Cisco 5400 Enterprise Network Compute System firmware | <=4.4.2 | |
| Cisco ENCS 5400 Firmware | ||
| Cisco C220 M6 | <=4.1\(2f\) | |
| Cisco C220 M6 Firmware | ||
| Cisco c225 M6 Firmware | <=4.1\(2f\) | |
| Cisco c225 M6 Firmware | ||
| Cisco C240 M6 Firmware | <=4.1\(2f\) | |
| Cisco C240 M6 Firmware | ||
| Cisco UCS C245 M6 Firmware | <=4.1\(2f\) | |
| Cisco UCS C245 M6 | ||
| Cisco C125 M5 Firmware | <=4.1\(2f\) | |
| Cisco C125 M5 Firmware | ||
| Cisco C220 M5 Firmware | <=4.1\(2f\) | |
| Cisco C220 M5 Firmware | ||
| Cisco C240 M5 Firmware | <=4.1\(2f\) | |
| Cisco C240 M5 Firmware | ||
| Cisco UCS C480 M5 Firmware | <=4.1\(2f\) | |
| Cisco UCS C480 M5 Firmware | ||
| Cisco UCS C480 ML M5 Firmware | <=4.1\(2f\) | |
| Cisco UCS C480 ML M5 Firmware | ||
| Cisco UCS E140S M2 | <=3.2\(11.5\) | |
| Cisco UCS-E140S-M1 Firmware | ||
| Cisco UCS-E140D Firmware | <=3.2\(11.5\) | |
| Cisco UCS-E140D Firmware | ||
| Cisco UCS-E160D Firmware | <=3.2\(11.5\) | |
| Cisco UCS-E160D Firmware | ||
| Cisco UCS E160S M3 Firmware | <=3.2\(11.5\) | |
| Cisco UCS-E160S-M3 Firmware | ||
| Cisco UCS E180D M3 Firmware | <=3.2\(11.5\) | |
| Cisco UCS E180D M3 Firmware | ||
| Cisco UCS E1120D M3 | <=3.2\(11.5\) | |
| Cisco ucs-e1120d-m3 firmware | ||
| Cisco UCS-E140S Firmware | <=3.2\(11.5\) | |
| Cisco UCS-E140S-M2 Firmware | ||
| Cisco UCS-E180D-M2 Firmware | <=3.2\(11.5\) | |
| Cisco UCS-E180D-M2 Firmware | ||
| Cisco UCS E140S M1 | <=3.2\(11.5\) | |
| Cisco UCS E140S M1 | ||
| Cisco UCS-E140DP Firmware | <=3.2\(11.5\) | |
| Cisco UCS E140DP | ||
| Cisco UCS-E160DP-M1 | <=3.2\(11.5\) | |
| Cisco UCS-E160DP-M1 Firmware | ||
| Cisco UCS S3260 Firmware | <=4.0\(2o\) | |
| Cisco UCS S3260 Firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this Cisco vulnerability?
The vulnerability ID is CVE-2021-1397.
What is the severity level of CVE-2021-1397?
The severity level of CVE-2021-1397 is medium.
Which software is affected by CVE-2021-1397?
The affected software includes Cisco Integrated Management Controller (IMC) Software, Cisco UCS Manager, and Cisco Encs 5100 Firmware.
How does the vulnerability in CVE-2021-1397 occur?
The vulnerability occurs due to improper input validation of the parameters in an HTTP request in the web-based management interface of Cisco Integrated Management Controller (IMC) Software.
Is there a fix available for CVE-2021-1397?
Yes, Cisco has released software updates to address the vulnerability. Please refer to the reference link for more information.
- agent/type
- agent/references
- agent/weakness
- agent/title
- agent/severity
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/first-publish-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco integrated management controller
- canonical/cisco ucs manager
- version/cisco ucs manager/4.1\(3b\)
- canonical/cisco 5100 enterprise network compute system firmware
- version/cisco 5100 enterprise network compute system firmware/4.4.2
- canonical/cisco encs 5100
- canonical/cisco 5400 enterprise network compute system firmware
- version/cisco 5400 enterprise network compute system firmware/4.4.2
- canonical/cisco encs 5400 firmware
- canonical/cisco c220 m6
- version/cisco c220 m6/4.1\(2f\)
- canonical/cisco c220 m6 firmware
- canonical/cisco c225 m6 firmware
- version/cisco c225 m6 firmware/4.1\(2f\)
- canonical/cisco c240 m6 firmware
- version/cisco c240 m6 firmware/4.1\(2f\)
- canonical/cisco ucs c245 m6 firmware
- version/cisco ucs c245 m6 firmware/4.1\(2f\)
- canonical/cisco ucs c245 m6
- canonical/cisco c125 m5 firmware
- version/cisco c125 m5 firmware/4.1\(2f\)
- canonical/cisco c220 m5 firmware
- version/cisco c220 m5 firmware/4.1\(2f\)
- canonical/cisco c240 m5 firmware
- version/cisco c240 m5 firmware/4.1\(2f\)
- canonical/cisco ucs c480 m5 firmware
- version/cisco ucs c480 m5 firmware/4.1\(2f\)
- canonical/cisco ucs c480 ml m5 firmware
- version/cisco ucs c480 ml m5 firmware/4.1\(2f\)
- canonical/cisco ucs e140s m2
- version/cisco ucs e140s m2/3.2\(11.5\)
- canonical/cisco ucs-e140s-m1 firmware
- canonical/cisco ucs-e140d firmware
- version/cisco ucs-e140d firmware/3.2\(11.5\)
- canonical/cisco ucs-e160d firmware
- version/cisco ucs-e160d firmware/3.2\(11.5\)
- canonical/cisco ucs e160s m3 firmware
- version/cisco ucs e160s m3 firmware/3.2\(11.5\)
- canonical/cisco ucs-e160s-m3 firmware
- canonical/cisco ucs e180d m3 firmware
- version/cisco ucs e180d m3 firmware/3.2\(11.5\)
- canonical/cisco ucs e1120d m3
- version/cisco ucs e1120d m3/3.2\(11.5\)
- canonical/cisco ucs-e1120d-m3 firmware
- canonical/cisco ucs-e140s firmware
- version/cisco ucs-e140s firmware/3.2\(11.5\)
- canonical/cisco ucs-e140s-m2 firmware
- canonical/cisco ucs-e180d-m2 firmware
- version/cisco ucs-e180d-m2 firmware/3.2\(11.5\)
- canonical/cisco ucs e140s m1
- version/cisco ucs e140s m1/3.2\(11.5\)
- canonical/cisco ucs-e140dp firmware
- version/cisco ucs-e140dp firmware/3.2\(11.5\)
- canonical/cisco ucs e140dp
- canonical/cisco ucs-e160dp-m1
- version/cisco ucs-e160dp-m1/3.2\(11.5\)
- canonical/cisco ucs-e160dp-m1 firmware
- canonical/cisco ucs s3260 firmware
- version/cisco ucs s3260 firmware/4.0\(2o\)