CVE-2020-3337 Cisco Umbrella Open Redirect Vulnerability
An unauthenticated remote attacker can redirect users to malicious websites via crafted HTTP requests in Cisco Umbrella.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-3337?
CVE-2020-3337 is a medium-severity vulnerability in Cisco Umbrella, published on 18 Jun 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in the web server of Cisco Umbrella could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. The vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request that could cause the web application to redirect the request to a specified malicious URL. A successful exploit could allow the attacker to redirect a user to a malicious website.
Weakness: CWE-601
Which versions are affected by CVE-2020-3337?
It affects 1 product.
Products include Cisco Umbrella.
How do I fix CVE-2020-3337?
No fix has been published for CVE-2020-3337 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-3337 being exploited?
There is no known exploitation of CVE-2020-3337 in the wild and no public exploit code.
Other vulnerabilities in Cisco Umbrella
- CVE-2018-0435 Cisco Umbrella API Unauthorized Access Vulnerability
- CVE-2019-1807 Cisco Umbrella Dashboard Session Management Vulnerability
- CVE-2021-1474 Cisco Umbrella Link and CSV Formula Injection Vulnerabilities
- CVE-2021-1475 Cisco Umbrella Link and CSV Formula Injection Vulnerabilities
- CVE-2019-1792 Cisco Umbrella Cross-Site Scripting Vulnerability
Sources
Also known as GHSA-hf79-5ffr-p77w.