First published: Thu May 06 2021(Updated: )
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website. This vulnerability is known as an open redirect attack, which is used in phishing attacks to get users to visit malicious sites without their knowledge.
Credit: ykramarz@cisco.com
Affected Software | Affected Version | How to fix |
---|---|---|
Cisco Integrated Management Controller | <3.2\(12.4\) | |
Cisco UCS Manager | <=4.1\(3b\) | |
Cisco Encs 5100 Firmware | <=4.4.2 | |
Cisco Encs 5100 | ||
Cisco Encs 5400 Firmware | <=4.4.2 | |
Cisco Encs 5400 | ||
Cisco C220 M6 Firmware | <=4.1\(2f\) | |
Cisco C220 M6 | ||
Cisco C225 M6 Firmware | <=4.1\(2f\) | |
Cisco C225 M6 | ||
Cisco C240 M6 Firmware | <=4.1\(2f\) | |
Cisco C240 M6 | ||
Cisco C245 M6 Firmware | <=4.1\(2f\) | |
Cisco C245 M6 | ||
Cisco C125 M5 Firmware | <=4.1\(2f\) | |
Cisco C125 M5 | ||
Cisco C220 M5 Firmware | <=4.1\(2f\) | |
Cisco C220 M5 | ||
Cisco C240 M5 Firmware | <=4.1\(2f\) | |
Cisco C240 M5 | ||
Cisco C480 M5 Firmware | <=4.1\(2f\) | |
Cisco C480 M5 | ||
Cisco C480 Ml M5 Firmware | <=4.1\(2f\) | |
Cisco C480 Ml M5 | ||
Cisco Ucs-e140s Firmware | <=3.2\(11.5\) | |
Cisco Ucs-e140s | ||
Cisco Ucs-e140d Firmware | <=3.2\(11.5\) | |
Cisco Ucs-e140d | ||
Cisco Ucs-e160d Firmware | <=3.2\(11.5\) | |
Cisco Ucs-e160d | ||
Cisco Ucs-e160s-m3 Firmware | <=3.2\(11.5\) | |
Cisco Ucs-e160s-m3 | ||
Cisco Ucs-e180d-m3 Firmware | <=3.2\(11.5\) | |
Cisco Ucs-e180d-m3 | ||
Cisco Ucs-e1120d-m3 Firmware | <=3.2\(11.5\) | |
Cisco Ucs-e1120d-m3 | ||
Cisco Ucs-e140s-m2 Firmware | <=3.2\(11.5\) | |
Cisco Ucs-e140s-m2 | ||
Cisco Ucs-e180d-m2 Firmware | <=3.2\(11.5\) | |
Cisco Ucs-e180d-m2 | ||
Cisco Ucs-e140s-m1 Firmware | <=3.2\(11.5\) | |
Cisco Ucs-e140s-m1 | ||
Cisco Ucs-e140dp Firmware | <=3.2\(11.5\) | |
Cisco Ucs-e140dp | ||
Cisco Ucs-e160dp-m1 Firmware | <=3.2\(11.5\) | |
Cisco Ucs-e160dp-m1 | ||
Cisco Ucs S3260 Firmware | <=4.0\(2o\) | |
Cisco Ucs S3260 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID is CVE-2021-1397.
The severity level of CVE-2021-1397 is medium.
The affected software includes Cisco Integrated Management Controller (IMC) Software, Cisco UCS Manager, and Cisco Encs 5100 Firmware.
The vulnerability occurs due to improper input validation of the parameters in an HTTP request in the web-based management interface of Cisco Integrated Management Controller (IMC) Software.
Yes, Cisco has released software updates to address the vulnerability. Please refer to the reference link for more information.