Lucene search

CiscoCVE-2019-1943

HistoryJul 17, 2019 - 9:15 p.m.

CVE-2019-1943

2019-07-1721:15:12

CWE-601

cisco

web.nvd.nist.gov

cve-2019-1943

cisco

small business

switches

vulnerability

remote attack

http

input validation

open redirect

phishing

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.1

Confidence

High

EPSS

0.053

Percentile

93.1%

JSON

A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Switches software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by intercepting a user’s HTTP request and modifying it into a request that causes the web interface to redirect the user to a specific malicious URL. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites.

Affected configurations

Nvd

Node

ciscosg200-50_firmwareMatch-

AND

ciscosg200-50Match-

Node

ciscosg200-50p_firmwareMatch-

AND

ciscosg200-50pMatch-

Node

ciscosg200-50fp_firmwareMatch-

AND

ciscosg200-50fpMatch-

Node

ciscosg200-26_firmwareMatch-

AND

ciscosg200-26Match-

Node

ciscosg200-26p_firmwareMatch-

AND

ciscosg200-26pMatch-

Node

ciscosg200-26fp_firmwareMatch-

AND

ciscosg200-26fpMatch-

Node

ciscosg200-18_firmwareMatch-

AND

ciscosg200-18Match-

Node

ciscosg200-10fp_firmwareMatch-

AND

ciscosg200-10fpMatch-

Node

ciscosg200-08_firmwareMatch-

AND

ciscosg200-08Match-

Node

ciscosg200-08p_firmwareMatch-

AND

ciscosg200-08pMatch-

Node

ciscosf200-24_firmwareMatch-

AND

ciscosf200-24Match-

Node

ciscosf200-24p_firmwareMatch-

AND

ciscosf200-24pMatch-

Node

ciscosf200-24fp_firmwareMatch-

AND

ciscosf200-24fpMatch-

Node

ciscosf200-48_firmwareMatch-

AND

ciscosf200-48Match-

Node

ciscosf200-48p_firmwareMatch-

AND

ciscosf200-48pMatch-

Node

ciscosf302-08pp_firmwareMatch1.3.7.18

AND

ciscosf302-08ppMatch-

Node

ciscosf302-08mpp_firmwareMatch1.3.7.18

AND

ciscosf302-08mppMatch-

Node

ciscosg300-10pp_firmwareMatch1.3.7.18

AND

ciscosg300-10ppMatch-

Node

ciscosg300-10mpp_firmwareMatch1.3.7.18

AND

ciscosg300-10mppMatch-

Node

ciscosf300-24pp_firmwareMatch1.3.7.18

AND

ciscosf300-24ppMatch-

Node

ciscosf300-48pp_firmwareMatch1.3.7.18

AND

ciscosf300-48ppMatch-

Node

ciscosg300-28pp_firmwareMatch1.3.7.18

AND

ciscosg300-28ppMatch-

Node

ciscosf300-08_firmwareMatch1.3.7.18

AND

ciscosf300-08Match-

Node

ciscosf300-48p_firmwareMatch1.3.7.18

AND

ciscosf300-48pMatch-

Node

ciscosg300-10mp_firmwareMatch1.3.7.18

AND

ciscosg300-10mpMatch-

Node

ciscosg300-10p_firmwareMatch1.3.7.18

AND

ciscosg300-10pMatch-

Node

ciscosg300-10_firmwareMatch1.3.7.18

AND

ciscosg300-10Match-

Node

ciscosg300-28p_firmwareMatch1.3.7.18

AND

ciscosg300-28pMatch-

Node

ciscosf300-24p_firmwareMatch1.3.7.18

AND

ciscosf300-24pMatch-

Node

ciscosf302-08mp_firmwareMatch1.3.7.18

AND

ciscosf302-08mpMatch-

Node

ciscosg300-28_firmwareMatch1.3.7.18

AND

ciscosg300-28Match-

Node

ciscosf300-48_firmwareMatch1.3.7.18

AND

ciscosf300-48Match-

Node

ciscosg300-20_firmwareMatch1.3.7.18

AND

ciscosg300-20Match-

Node

ciscosf302-08p_firmwareMatch1.3.7.18

AND

ciscosf302-08pMatch-

Node

ciscosg300-52_firmwareMatch1.3.7.18

AND

ciscosg300-52Match-

Node

ciscosf300-24_firmwareMatch1.3.7.18

AND

ciscosf300-24Match-

Node

ciscosf302-08_firmwareMatch1.3.7.18

AND

ciscosf302-08Match-

Node

ciscosf300-24mp_firmwareMatch1.3.7.18

AND

ciscosf300-24mpMatch-

Node

ciscosg300-10sfp_firmwareMatch1.3.7.18

AND

ciscosg300-10sfpMatch-

Node

ciscosg300-28mp_firmwareMatch1.3.7.18

AND

ciscosg300-28mpMatch-

Node

ciscosg300-52p_firmwareMatch1.3.7.18

AND

ciscosg300-52pMatch-

Node

ciscosg300-52mp_firmwareMatch1.3.7.18

AND

ciscosg300-52mpMatch-

Node

ciscosg500-28mpp_firmwareMatch-

AND

ciscosg500-28mppMatch-

Node

ciscosg500-52mp_firmwareMatch-

AND

ciscosg500-52mpMatch-

Node

ciscosg500xg-8f8t_firmwareMatch-

AND

ciscosg500xg-8f8tMatch-

Node

ciscosf500-24_firmwareMatch-

AND

ciscosf500-24Match-

Node

ciscosf500-24p_firmwareMatch-

AND

ciscosf500-24pMatch-

Node

ciscosf500-48_firmwareMatch-

AND

ciscosf500-48Match-

Node

ciscosf500-48p_firmwareMatch-

AND

ciscosf500-48pMatch-

Node

ciscosg500-28_firmwareMatch-

AND

ciscosg500-28Match-

Node

ciscosg500-28p_firmwareMatch-

AND

ciscosg500-28pMatch-

Node

ciscosg500-52_firmwareMatch-

AND

ciscosg500-52Match-

Node

ciscosg500-52p_firmwareMatch-

AND

ciscosg500-52pMatch-

Node

ciscosg500x-24_firmwareMatch-

AND

ciscosg500x-24Match-

Node

ciscosg500x-24p_firmwareMatch-

AND

ciscosg500x-24pMatch-

Node

ciscosg500x-48_firmwareMatch-

AND

ciscosg500x-48Match-

Node

ciscosg500x-48p_firmwareMatch-

AND

ciscosg500x-48pMatch-

VendorProductVersionCPE
ciscosg200-50_firmware-cpe:2.3:o:cisco:sg200-50_firmware:-:*:*:*:*:*:*:*
ciscosg200-50-cpe:2.3:h:cisco:sg200-50:-:*:*:*:*:*:*:*
ciscosg200-50p_firmware-cpe:2.3:o:cisco:sg200-50p_firmware:-:*:*:*:*:*:*:*
ciscosg200-50p-cpe:2.3:h:cisco:sg200-50p:-:*:*:*:*:*:*:*
ciscosg200-50fp_firmware-cpe:2.3:o:cisco:sg200-50fp_firmware:-:*:*:*:*:*:*:*
ciscosg200-50fp-cpe:2.3:h:cisco:sg200-50fp:-:*:*:*:*:*:*:*
ciscosg200-26_firmware-cpe:2.3:o:cisco:sg200-26_firmware:-:*:*:*:*:*:*:*
ciscosg200-26-cpe:2.3:h:cisco:sg200-26:-:*:*:*:*:*:*:*
ciscosg200-26p_firmware-cpe:2.3:o:cisco:sg200-26p_firmware:-:*:*:*:*:*:*:*
ciscosg200-26p-cpe:2.3:h:cisco:sg200-26p:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	sg200-50_firmware	-	cpe:2.3:o:cisco:sg200-50_firmware:-:::::::*
cisco	sg200-50	-	cpe:2.3:h:cisco:sg200-50:-:::::::*
cisco	sg200-50p_firmware	-	cpe:2.3:o:cisco:sg200-50p_firmware:-:::::::*
cisco	sg200-50p	-	cpe:2.3:h:cisco:sg200-50p:-:::::::*
cisco	sg200-50fp_firmware	-	cpe:2.3:o:cisco:sg200-50fp_firmware:-:::::::*
cisco	sg200-50fp	-	cpe:2.3:h:cisco:sg200-50fp:-:::::::*
cisco	sg200-26_firmware	-	cpe:2.3:o:cisco:sg200-26_firmware:-:::::::*
cisco	sg200-26	-	cpe:2.3:h:cisco:sg200-26:-:::::::*
cisco	sg200-26p_firmware	-	cpe:2.3:o:cisco:sg200-26p_firmware:-:::::::*
cisco	sg200-26p	-	cpe:2.3:h:cisco:sg200-26p:-:::::::*

Rows per page:

1-10 of 1141

CNA Affected

[
  {
    "product": "Cisco Small Business 300 Series Managed Switches",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "1.3.7.18"
      }
    ]
  }
]

References

www.securityfocus.com/bid/109288

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190717-sbss-redirect

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

AI Score

6.1

Confidence

High

EPSS

0.053

Percentile

93.1%

JSON

Related for CVE-2019-1943