cisco-sa-20181003-er-ucm-redirect: Multiple Cisco Unified Communications Products Open Redirect Vulnerability
First published: Wed Oct 03 2018(Updated: )
A vulnerability in the web interface of Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an authenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by crafting an HTTP request that causes the web interface to redirect a request to a specific malicious URL. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites. There are no workarounds that address this vulnerability. This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-er-ucm-redirect
Credit: This vulnerability was found during the resolution a Cisco TAC support case
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Emergency Responder | ||
| Cisco Unified Communications Manager Session Management Edition | ||
| Cisco Unified Communications Manager IM and Presence | ||
| Cisco Unity Connection 8.6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of cisco-sa-20181003-er-ucm-redirect?
The severity of cisco-sa-20181003-er-ucm-redirect is classified as high due to the potential for remote attackers to redirect users.
How do I fix cisco-sa-20181003-er-ucm-redirect?
To fix cisco-sa-20181003-er-ucm-redirect, update the affected Cisco software to the latest secure version as recommended in the advisory.
What products are affected by cisco-sa-20181003-er-ucm-redirect?
The affected products include Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection.
What type of vulnerability is cisco-sa-20181003-er-ucm-redirect?
cisco-sa-20181003-er-ucm-redirect is a web interface vulnerability that allows unauthorized redirection to malicious web pages.
Is authentication required to exploit cisco-sa-20181003-er-ucm-redirect?
Yes, an authenticated remote attacker is required to exploit the vulnerability in cisco-sa-20181003-er-ucm-redirect.
- agent/type
- agent/event
- agent/last-modified-date
- agent/first-publish-date
- collector/cisco-advisory
- source/Cisco
- agent/references
- agent/weakness
- agent/severity
- agent/author
- agent/title
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco emergency responder
- canonical/cisco unified communications manager session management edition
- canonical/cisco unified communications manager im and presence
- canonical/cisco unity connection 8.6