PT-2018-13014 · Cisco · Cisco Unified Communications Manager+3

Publicado 2018-10-05 · Atualizado 2019-10-09 · CVE-2018-15403

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Emergency Responder (affected versions not specified) Cisco Unified Communications Manager (affected versions not specified) Cisco Unified Communications Manager IM & Presence Service (affected versions not specified) Cisco Unity Connection (affected versions not specified)

Description The issue is related to improper input validation of HTTP request parameters, allowing an authenticated, remote attacker to redirect users to a malicious web page through an open redirect attack. This can be used in phishing attacks to trick users into visiting malicious sites.

Recommendations For Cisco Emergency Responder, update to a version that fixes the improper input validation issue. For Cisco Unified Communications Manager, update to a version that fixes the improper input validation issue. For Cisco Unified Communications Manager IM & Presence Service, update to a version that fixes the improper input validation issue. For Cisco Unity Connection, update to a version that fixes the improper input validation issue.

Correção

Open Redirect

Enumeração de Fraquezas

CWE-601

Identificadores relacionados

CVE-2018-15403

Produtos afetados

Cisco Emergency Responder

Cisco Unified Communications Manager

Cisco Unified Communications Manager Im & Presence Service

Cisco Unity Connection

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-15403 · Nota de Segurança
• http://securitytracker.com/id/1041789 · Nota
• http://securitytracker.com/id/1041780 · Nota
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-er-ucm-redirect · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-15403 · Aviso do Fabricante