cisco-sa-20181003-er-ucm-redirect: Multiple Cisco Unified Communications Products Open Redirect Vulnerability
A vulnerability in the web interface of Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an authenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by crafting an HTTP request that causes the web interface to redirect a request to a specific malicious URL. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites.
There are no workarounds that address this vulnerability.
This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-er-ucm-redirect
Credit
Affected Software
Event History
Frequently Asked Questions
What is the severity of cisco-sa-20181003-er-ucm-redirect?
The severity of cisco-sa-20181003-er-ucm-redirect is classified as high due to the potential for remote attackers to redirect users.
How do I fix cisco-sa-20181003-er-ucm-redirect?
To fix cisco-sa-20181003-er-ucm-redirect, update the affected Cisco software to the latest secure version as recommended in the advisory.
What products are affected by cisco-sa-20181003-er-ucm-redirect?
The affected products include Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection.
What type of vulnerability is cisco-sa-20181003-er-ucm-redirect?
cisco-sa-20181003-er-ucm-redirect is a web interface vulnerability that allows unauthorized redirection to malicious web pages.
Is authentication required to exploit cisco-sa-20181003-er-ucm-redirect?
Yes, an authenticated remote attacker is required to exploit the vulnerability in cisco-sa-20181003-er-ucm-redirect.