CVE-2023-20263 Open redirect in Cisco HyperFlex HX Data Platform
An unauthenticated remote attacker can redirect users to malicious websites via crafted links in the Cisco HyperFlex HX Data Platform web interface.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2023-20263?
CVE-2023-20263 is a medium-severity vulnerability in Cisco HyperFlex HX Data Platform, published on 6 Sep 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of the parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website.
Weakness: CWE-601
Which versions are affected by CVE-2023-20263?
It affects 1 product.
Products include Cisco Hyperflex Hx Data Platform.
How do I fix CVE-2023-20263?
No fix has been published for CVE-2023-20263 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-20263 being exploited?
There is no known exploitation of CVE-2023-20263 in the wild and no public exploit code.
Other vulnerabilities in Cisco HyperFlex HX Data Platform
- CVE-2021-1497 Cisco HyperFlex HX Installer Virtual Machine Command Injection
- CVE-2021-1498 Cisco HyperFlex HX Data Platform Command Injection
- CVE-2018-15380 Cisco HyperFlex Software Command Injection Vulnerability
- CVE-2018-15382 Cisco HyperFlex Software Static Signing Key Vulnerability
- CVE-2019-1664 Cisco HyperFlex Software Unauthenticated Root Access Vulnerability
Sources
Also known as GHSA-fr6h-cvqr-2jq8.