CVE-2021-1397

A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website. This vulnerability is known as an open redirect attack, which is used in phishing attacks to get users to visit malicious sites without their knowledge.

• cisco integrated management controller (< 3.2\(12.4\)) • cisco ucs manager (<= 4.1\(3b\)) • cisco encs 5100 firmware (<= 4.4.2) • cisco encs 5400 firmware (<= 4.4.2) • cisco c220 m6 firmware (<= 4.1\(2f\)) • cisco c225 m6 firmware (<= 4.1\(2f\)) • cisco c240 m6 firmware (<= 4.1\(2f\)) • cisco c245 m6 firmware (<= 4.1\(2f\)) • cisco c125 m5 firmware (<= 4.1\(2f\)) • cisco c220 m5 firmware (<= 4.1\(2f\)) • cisco c240 m5 firmware (<= 4.1\(2f\)) • cisco c480 m5 firmware (<= 4.1\(2f\)) • cisco c480 ml m5 firmware (<= 4.1\(2f\)) • cisco ucs-e140s firmware (<= 3.2\(11.5\)) • cisco ucs-e140d firmware (<= 3.2\(11.5\)) • cisco ucs-e160d firmware (<= 3.2\(11.5\)) • cisco ucs-e160s-m3 firmware (<= 3.2\(11.5\)) • cisco ucs-e180d-m3 firmware (<= 3.2\(11.5\)) • cisco ucs-e1120d-m3 firmware (<= 3.2\(11.5\)) • cisco ucs-e140s-m2 firmware (<= 3.2\(11.5\)) • cisco ucs-e180d-m2 firmware (<= 3.2\(11.5\)) • cisco ucs-e140s-m1 firmware (<= 3.2\(11.5\)) • cisco ucs-e140dp firmware (<= 3.2\(11.5\)) • cisco ucs-e160dp-m1 firmware (<= 3.2\(11.5\)) • cisco ucs s3260 firmware (<= 4.0\(2o\))