CVE-2021-1397
Description
A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website. This vulnerability is known as an open redirect attack, which is used in phishing attacks to get users to visit malicious sites without their knowledge.
How to fix
- cisco integrated_management_controller3.2\(12.4\) or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cisco integrated_management_controller | v < 3.2\(12.4\) | 3.2\(12.4\) |
| cisco ucs_manager | v ≤ 4.1\(3b\) | — |
| cisco encs_5100_firmware | v ≤ 4.4.2 | — |
| cisco encs_5400_firmware | v ≤ 4.4.2 | — |
| cisco c220_m6_firmware | v ≤ 4.1\(2f\) | — |
| cisco c225_m6_firmware | v ≤ 4.1\(2f\) | — |
| cisco c240_m6_firmware | v ≤ 4.1\(2f\) | — |
| cisco c245_m6_firmware | v ≤ 4.1\(2f\) | — |
| cisco c125_m5_firmware | v ≤ 4.1\(2f\) | — |
| cisco c220_m5_firmware | v ≤ 4.1\(2f\) | — |
| cisco c240_m5_firmware | v ≤ 4.1\(2f\) | — |
| cisco c480_m5_firmware | v ≤ 4.1\(2f\) | — |
| cisco c480_ml_m5_firmware | v ≤ 4.1\(2f\) | — |
| cisco ucs-e140s_firmware | v ≤ 3.2\(11.5\) | — |
| cisco ucs-e140d_firmware | v ≤ 3.2\(11.5\) | — |
| cisco ucs-e160d_firmware | v ≤ 3.2\(11.5\) | — |
| cisco ucs-e160s-m3_firmware | v ≤ 3.2\(11.5\) | — |
| cisco ucs-e180d-m3_firmware | v ≤ 3.2\(11.5\) | — |
| cisco ucs-e1120d-m3_firmware | v ≤ 3.2\(11.5\) | — |
| cisco ucs-e140s-m2_firmware | v ≤ 3.2\(11.5\) | — |
| cisco ucs-e180d-m2_firmware | v ≤ 3.2\(11.5\) | — |
| cisco ucs-e140s-m1_firmware | v ≤ 3.2\(11.5\) | — |
| cisco ucs-e140dp_firmware | v ≤ 3.2\(11.5\) | — |
| cisco ucs-e160dp-m1_firmware | v ≤ 3.2\(11.5\) | — |
| cisco ucs_s3260_firmware | v ≤ 4.0\(2o\) | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.