CVE-2018-15403: cisco cisco emergency responder Open Redirect
Vulnerability summary
CVE-2018-15403 is a medium (CVSS 5.4) Open Redirect vulnerability in cisco cisco emergency responder. EPSS estimates a 1.22% chance of exploitation in the next 30 days, higher than 68.1% of scored vulnerabilities.
Timeline
- 05-10-2018PublishedVulnerability first disclosed.
- 26-11-2024Last modifiedVulnerability information updated.
Description
A vulnerability in the web interface of Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an authenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by crafting an HTTP request that causes the web interface to redirect a request to a specific malicious URL. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.22%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
0.00 pp
From 1.22% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Cisco5 products
- cisco emergency respondern/a
- emergency_responder11.5\(4.59000.1\) | 12.0\(1.40000.3\) | 12.5\(0.98000.110\)
- unified_communications_manager10.5\(2.10000.5\) | 11.0\(1.10000.10\) | 11.5\(1.10000.6\) | 12.0\(1.10000.10\)
- unified_communications_manager_im_and_presence_service10.5\(1\) | 10.5\(2\) | 12.0\(1\) | 12.5\(1\)
- unity_connection9.1\(1\)es23
1 vendor · 5 products
References
3 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-er-ucm-redirectVendor AdvisoryX Refsource CISCO