Cisco Emergency Responder Open Redirect (cisco-sa-20181003-er-ucm-redirect)

medium Nessus Plugin ID 130069

Language:

Synopsis

The remote host is missing a vendor-supplied security patch.

Description

According to its self-reported version, the Cisco Emergency Responder (CER) is affected by an open redirect vulnerability.
The vulnerability in the web interface of Cisco Emergency Responder could allow an authenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by crafting an HTTP request that causes the web interface to redirect a request to a specific malicious URL. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites.

Solution

Apply the patch or upgrade to the version recommended in Cisco bug ID CSCvj59218

Plugin Details

Severity: Medium

ID: 130069

File Name: cisco-sa-20181003-er-ucm-redirect.nasl

Version: 1.2

Type: local

Family: CISCO

Published: 10/21/2019

Updated: 10/30/2019

Configuration: Enable paranoid mode

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.0

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 3.6

Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:N

CVSS Score Source: CVE-2018-15403

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:cisco:emergency_responder

Required KB Items: installed_sw/Cisco Emergency Responder (CER), Settings/ParanoidReport

Exploit Ease: No known exploits are available

Patch Publication Date: 10/3/2018

Vulnerability Publication Date: 10/3/2018

Reference Information

CVE: CVE-2018-15403

CWE: 79

CISCO-SA: cisco-sa-20170906-cuic

CISCO-BUG-ID: CSCvj59218

Detections

Analytics