PT-2023-4965 · Cisco · Cisco Hyperflex Hx Data Platform

Published 2023-09-06 · Updated 2024-12-29 · CVE-2023-20263

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco HyperFlex HX Data Platform versions 5.0 through 5.5

Description The issue is related to improper input validation of parameters in an HTTP request, allowing an unauthenticated, remote attacker to redirect a user to a malicious web page by persuading them to click a crafted link. This could enable the attacker to redirect the user to any arbitrary URL.

Recommendations For Cisco HyperFlex HX Data Platform versions 5.0 through 5.5, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2023-05503

CVE-2023-20263

Affected Products

Cisco Hyperflex Hx Data Platform

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2023-20263 · Security Note
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-hyperflex-redirect-UxLgqdUF · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05503 · Security Note
• https://osv.dev/vulnerability/CVE-2023-20263 · Vendor Advisory
• https://t.me/cibsecurity/70026 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1699522992181580219 · Twitter Post
• https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve · Note
• https://t.me/aptreports/15118 · Telegram Post
• https://twitter.com/rst_cloud/status/1848803894505160791 · Twitter Post
• https://twitter.com/CVEnew/status/1699474611941806217 · Twitter Post
• https://t.me/aptreports/13553 · Telegram Post
• https://t.me/cvenotify/57670 · Telegram Post