中文描述:

Cisco Enterprise Chat and Email（CEC）是美国思科（Cisco）公司的一套企业聊天和电子邮件解决方案。该产品主要为其它Cisco解决方案提供电子邮件、聊天和Web回调功能等。 Cisco Enterprise Chat and Email存在输入验证错误漏洞，该漏洞源于 Cisco ECE 基于 Web 的管理界面中的一个漏洞可能允许未经身份验证的远程攻击者将用户重定向到不需要的网页。此漏洞是由于对发送到 受影响的系统。 攻击者可以通过诱使界面用户单击精心制作的链接来利用此漏洞。 成功的利用可能允许攻击者使界面将用户重定向到特定的恶意 URL。 这种类型的漏洞称为开放重定向，用于网络钓鱼攻击，使用户在不知不觉中访问恶意网站。

英文描述:

A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. This vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a crafted link. A successful exploit could allow the attacker to cause the interface to redirect the user to a specific, malicious URL. This type of vulnerability is known as an open redirect and is used in phishing attacks that get users to unknowingly visit malicious sites.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.

CWE类型:

标签:

中文解决方案:

英文解决方案:

临时解决方案:

发布时间:

修改时间:

创建时间:

更新时间:

当前版本: v3

主要语言: EN

支持语言: