Cisco Firepower Management Center Software Open Redirect Vulnerability (Cisco Cisco Firepower Management Center)

CVE-2020-3558
MEDIUM 4.7

At a glance

Source
NVD
EPSS
EPSS 0.80 % Β· percentile 57 ()
State
PUBLISHED
Published
Updated
Assigner
cisco
NVD status
Modified

Description

A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by intercepting an HTTP request from a user. A successful exploit could allow the attacker to modify the HTTP request to cause the interface to redirect the user to a specific, malicious URL. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites.

Weaknesses (CWE)

  • CWE-601 β€” URL Redirection to Untrusted Site

References

Scores

VersionScoreVectorScored by
CVSS 3.1MEDIUM 4.7CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:Ncisco
CVSS 3.1MEDIUM 4.7CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:NNVD Β· psirt@cisco.com (Secondary)
CVSS 3.1MEDIUM 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NNVD Β· nvd@nist.gov (Primary)
CVSS 2.0MEDIUM 5.8AV:N/AC:M/Au:N/C:P/I:P/A:NNVD Β· nvd@nist.gov (Primary)

European references

Affected configurations (NVD CPE)

Affected products

ProductVersions
Cisco Β· Cisco Firepower Management Centeraffected n/a

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST β€” attribution requested
ENISA EUVDENISA β€” reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain β€” this product uses data from the NVD API but is not endorsed or certified by the NVD