cnvd - cnvd-2021-37592

cnvd-2021-37592

Vulnerability from cnvd

Title: Cisco Finesse开放重定向漏洞

Description:

Cisco Finesse是下一代座席和主管桌面，旨在为与您的客户服务组织进行交互的各种社区提供协作体验。

Cisco Finesse 12.6(1)及更早版本的Web管理界面存在开放重定向漏洞。该漏洞源于对发送到受影响系统的HTTP请求中URL参数的输入验证不当。攻击者可通过诱使界面用户点击特制链接利用该漏洞将用户重定向到特定的恶意URL。

Severity: 中

Patch Name: Cisco Finesse开放重定向漏洞的补丁

Patch Description:

Cisco Finesse是下一代座席和主管桌面，旨在为与您的客户服务组织进行交互的各种社区提供协作体验。

Cisco Finesse 12.6(1)及更早版本的Web管理界面存在开放重定向漏洞。该漏洞源于对发送到受影响系统的HTTP请求中URL参数的输入验证不当。攻击者可通过诱使界面用户点击特制链接利用该漏洞将用户重定向到特定的恶意URL。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-opn-rdrct-epDeh7R

Reference: https://nvd.nist.gov/vuln/detail/CVE-2021-1358

Impacted products

Name
Cisco Cisco Finesse <=12.6(1)

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-1358",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-1358"
    }
  },
  "description": "Cisco Finesse\u662f\u4e0b\u4e00\u4ee3\u5ea7\u5e2d\u548c\u4e3b\u7ba1\u684c\u9762\uff0c\u65e8\u5728\u4e3a\u4e0e\u60a8\u7684\u5ba2\u6237\u670d\u52a1\u7ec4\u7ec7\u8fdb\u884c\u4ea4\u4e92\u7684\u5404\u79cd\u793e\u533a\u63d0\u4f9b\u534f\u4f5c\u4f53\u9a8c\u3002\n\nCisco Finesse 12.6(1)\u53ca\u66f4\u65e9\u7248\u672c\u7684Web\u7ba1\u7406\u754c\u9762\u5b58\u5728\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5bf9\u53d1\u9001\u5230\u53d7\u5f71\u54cd\u7cfb\u7edf\u7684HTTP\u8bf7\u6c42\u4e2dURL\u53c2\u6570\u7684\u8f93\u5165\u9a8c\u8bc1\u4e0d\u5f53\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u8bf1\u4f7f\u754c\u9762\u7528\u6237\u70b9\u51fb\u7279\u5236\u94fe\u63a5\u5229\u7528\u8be5\u6f0f\u6d1e\u5c06\u7528\u6237\u91cd\u5b9a\u5411\u5230\u7279\u5b9a\u7684\u6076\u610fURL\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-opn-rdrct-epDeh7R",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-37592",
  "openTime": "2021-05-28",
  "patchDescription": "Cisco Finesse\u662f\u4e0b\u4e00\u4ee3\u5ea7\u5e2d\u548c\u4e3b\u7ba1\u684c\u9762\uff0c\u65e8\u5728\u4e3a\u4e0e\u60a8\u7684\u5ba2\u6237\u670d\u52a1\u7ec4\u7ec7\u8fdb\u884c\u4ea4\u4e92\u7684\u5404\u79cd\u793e\u533a\u63d0\u4f9b\u534f\u4f5c\u4f53\u9a8c\u3002\r\n\r\nCisco Finesse 12.6(1)\u53ca\u66f4\u65e9\u7248\u672c\u7684Web\u7ba1\u7406\u754c\u9762\u5b58\u5728\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u5bf9\u53d1\u9001\u5230\u53d7\u5f71\u54cd\u7cfb\u7edf\u7684HTTP\u8bf7\u6c42\u4e2dURL\u53c2\u6570\u7684\u8f93\u5165\u9a8c\u8bc1\u4e0d\u5f53\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u8bf1\u4f7f\u754c\u9762\u7528\u6237\u70b9\u51fb\u7279\u5236\u94fe\u63a5\u5229\u7528\u8be5\u6f0f\u6d1e\u5c06\u7528\u6237\u91cd\u5b9a\u5411\u5230\u7279\u5b9a\u7684\u6076\u610fURL\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Cisco Finesse\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Cisco Cisco Finesse \u003c=12.6(1)"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2021-1358",
  "serverity": "\u4e2d",
  "submitTime": "2021-05-20",
  "title": "Cisco Finesse\u5f00\u653e\u91cd\u5b9a\u5411\u6f0f\u6d1e"
}

CVE-2021-1358 (GCVE-0-2021-1358)

Vulnerability from cvelistv5

Published

2021-05-22 06:45

Modified

2024-11-08 21:14

Severity ?

4.7 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

CWE

CWE-601

Summary

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. This vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to cause the interface to redirect the user to a specific, malicious URL. This type of vulnerability is known as an open redirect and is used in phishing attacks that get users to unknowingly visit malicious sites.

References

▼	URL	Tags
	https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-opn-rdrct-epDeh7R	vendor-advisory, x_refsource_CISCO

Impacted products

	Vendor	Product	Version
	Cisco	Cisco Unified Contact Center Express	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T16:11:16.969Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "20210519 Cisco Finesse Open Redirect Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_refsource_CISCO",
              "x_transferred"
            ],
            "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-opn-rdrct-epDeh7R"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2021-1358",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-08T20:42:01.013691Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-08T21:14:21.414Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Unified Contact Center Express",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2021-05-19T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. This vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to cause the interface to redirect the user to a specific, malicious URL. This type of vulnerability is known as an open redirect and is used in phishing attacks that get users to unknowingly visit malicious sites."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-05-22T06:45:34",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "20210519 Cisco Finesse Open Redirect Vulnerability",
          "tags": [
            "vendor-advisory",
            "x_refsource_CISCO"
          ],
          "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-opn-rdrct-epDeh7R"
        }
      ],
      "source": {
        "advisory": "cisco-sa-finesse-opn-rdrct-epDeh7R",
        "defect": [
          [
            "CSCvw09349",
            "CSCvy20394",
            "CSCvy20396",
            "CSCvy20403"
          ]
        ],
        "discovery": "INTERNAL"
      },
      "title": "Cisco Finesse Open Redirect Vulnerability",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@cisco.com",
          "DATE_PUBLIC": "2021-05-19T16:00:00",
          "ID": "CVE-2021-1358",
          "STATE": "PUBLIC",
          "TITLE": "Cisco Finesse Open Redirect Vulnerability"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Cisco Unified Contact Center Express",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Cisco"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. This vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to cause the interface to redirect the user to a specific, malicious URL. This type of vulnerability is known as an open redirect and is used in phishing attacks that get users to unknowingly visit malicious sites."
            }
          ]
        },
        "exploit": [
          {
            "lang": "en",
            "value": "The Cisco Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of the vulnerability that is described in this advisory."
          }
        ],
        "impact": {
          "cvss": {
            "baseScore": "4.7",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-601"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "20210519 Cisco Finesse Open Redirect Vulnerability",
              "refsource": "CISCO",
              "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-finesse-opn-rdrct-epDeh7R"
            }
          ]
        },
        "source": {
          "advisory": "cisco-sa-finesse-opn-rdrct-epDeh7R",
          "defect": [
            [
              "CSCvw09349",
              "CSCvy20394",
              "CSCvy20396",
              "CSCvy20403"
            ]
          ],
          "discovery": "INTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2021-1358",
    "datePublished": "2021-05-22T06:45:34.127205Z",
    "dateReserved": "2020-11-13T00:00:00",
    "dateUpdated": "2024-11-08T21:14:21.414Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted