#VU7005 Open redirect in Cisco Unified Communications Domain Manager - CVE-2017-6670

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU7005

#VU7005 Open redirect in Cisco Unified Communications Domain Manager - CVE-2017-6670

Published: June 9, 2017


Vulnerability identifier: #VU7005
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2017-6670
CWE-ID: CWE-601
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
Cisco Unified Communications Domain Manager
Software vendor:
Cisco Systems, Inc

Description

The vulnerability allows a remote unauthenticated attacker to redirect website visitors to external websites.

The weakness exists in the web-based GUI of Cisco Unified Communications Domain Manager due to incorrect validation of redirected URL. A remote attacker can create a specially crafted link and redirect the victim on potentially dangerous website.

Successful exploitation of the vulnerability may allow an attacker to perform phishing attack.

Remediation

Install update from vendor's website.

External links