6.1

CVE-2021-1397

Cisco Integrated Management Controller Open Redirect Vulnerability

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website. This vulnerability is known as an open redirect attack, which is used in phishing attacks to get users to visit malicious sites without their knowledge.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Integrated Management Controller Version < 3.2\(12.4\)
Cisco ≫ Ucs Manager Version <= 4.1\(3b\)
Cisco ≫ Encs 5100 Firmware Version <= 4.4.2
   Cisco ≫ Encs 5100 Version -
Cisco ≫ Encs 5400 Firmware Version <= 4.4.2
   Cisco ≫ Encs 5400 Version -
Cisco ≫ C220 M6 Firmware Version <= 4.1\(2f\)
   Cisco ≫ C220 M6 Version -
Cisco ≫ C225 M6 Firmware Version <= 4.1\(2f\)
   Cisco ≫ C225 M6 Version -
Cisco ≫ C240 M6 Firmware Version <= 4.1\(2f\)
   Cisco ≫ C240 M6 Version -
Cisco ≫ C245 M6 Firmware Version <= 4.1\(2f\)
   Cisco ≫ C245 M6 Version -
Cisco ≫ C125 M5 Firmware Version <= 4.1\(2f\)
   Cisco ≫ C125 M5 Version -
Cisco ≫ C220 M5 Firmware Version <= 4.1\(2f\)
   Cisco ≫ C220 M5 Version -
Cisco ≫ C240 M5 Firmware Version <= 4.1\(2f\)
   Cisco ≫ C240 M5 Version -
Cisco ≫ C480 M5 Firmware Version <= 4.1\(2f\)
   Cisco ≫ C480 M5 Version -
Cisco ≫ C480 Ml M5 Firmware Version <= 4.1\(2f\)
   Cisco ≫ C480 Ml M5 Version -
Cisco ≫ Ucs-e140s Firmware Version <= 3.2\(11.5\)
   Cisco ≫ Ucs-e140s Version -
Cisco ≫ Ucs-e140d Firmware Version <= 3.2\(11.5\)
   Cisco ≫ Ucs-e140d Version -
Cisco ≫ Ucs-e160d Firmware Version <= 3.2\(11.5\)
   Cisco ≫ Ucs-e160d Version -
Cisco ≫ Ucs-e160s-m3 Firmware Version <= 3.2\(11.5\)
   Cisco ≫ Ucs-e160s-m3 Version -
Cisco ≫ Ucs-e180d-m3 Firmware Version <= 3.2\(11.5\)
   Cisco ≫ Ucs-e180d-m3 Version -
Cisco ≫ Ucs-e1120d-m3 Firmware Version <= 3.2\(11.5\)
   Cisco ≫ Ucs-e1120d-m3 Version -
Cisco ≫ Ucs-e140s-m2 Firmware Version <= 3.2\(11.5\)
   Cisco ≫ Ucs-e140s-m2 Version -
Cisco ≫ Ucs-e160d Firmware Version <= 3.2\(11.5\)
   Cisco ≫ Ucs-e160d Version -
Cisco ≫ Ucs-e180d-m2 Firmware Version <= 3.2\(11.5\)
   Cisco ≫ Ucs-e180d-m2 Version -
Cisco ≫ Ucs-e140s-m1 Firmware Version <= 3.2\(11.5\)
   Cisco ≫ Ucs-e140s-m1 Version -
Cisco ≫ Ucs-e140d Firmware Version <= 3.2\(11.5\)
   Cisco ≫ Ucs-e140d Version -
Cisco ≫ Ucs-e140dp Firmware Version <= 3.2\(11.5\)
   Cisco ≫ Ucs-e140dp Version -
Cisco ≫ Ucs-e160d Firmware Version <= 3.2\(11.5\)
   Cisco ≫ Ucs-e160d Version -
Cisco ≫ Ucs-e160dp-m1 Firmware Version <= 3.2\(11.5\)
   Cisco ≫ Ucs-e160dp-m1 Version -
Cisco ≫ Ucs S3260 Firmware Version <= 4.0\(2o\)
   Cisco ≫ Ucs S3260 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.83% 0.528
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.1 2.8 2.7
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NIST 5.8 8.6 4.9
AV:N/AC:M/Au:N/C:P/I:P/A:N
Cisco PSIRT 4.7 2.8 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-imc-openred-zAYrU6d2
Vendor Advisory