CVE-2017-6604 — Open Redirect in Cisco Unified Computing System

CWE-601 — Open RedirectCWE-20 — Improper Input Validation4 documents4 sources
Severity
6.1MEDIUMNVD
EPSS
0.3%
top 51.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Cisco Unified Computing System
Timeline
PublishedApr 7
Latest updateMay 17

Description

A vulnerability in the web interface of Cisco Integrated Management Controller (IMC) Software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability affects the following Cisco products running Cisco IMC Software: Unified Computing System (UCS) B-Series M3 and M4 Blade Servers, Unified Computing System (UCS) C-Series M3 and M4 Rack Servers. More Information: CSCvc37931. Known Affected Releases: 3.1(2c)B.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.7

Affected Packages1 packages

▶NVDcisco/unified_computing_system2.2\(8b\), 3.0\(1c\), 3.1\(2c\)b+2

🔴Vulnerability Details

2
GHSA
GHSA-gh63-grcf-3799: A vulnerability in the web interface of Cisco Integrated Management Controller (IMC) Software could allow an unauthenticated, remote attacker to redir↗2022-05-17
▶
CVEList
CVE-2017-6604: A vulnerability in the web interface of Cisco Integrated Management Controller (IMC) Software could allow an unauthenticated, remote attacker to redir↗2017-04-07
▶

📋Vendor Advisories

1
Cisco
Cisco Integrated Management Controller Redirection Vulnerability↗2017-04-05
▶
CVE-2017-6604 — Open Redirect in Cisco | cvebase