CVE-2024-20400 Open redirect in Cisco TelePresence Video Communication Server (VCS) Expressway

Medium 4.7 Published 17 Jul 2024 Updated 1 Aug 2024

An unauthenticated remote attacker can redirect users to malicious web pages via improper input validation in the Cisco Expressway web interface.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2024-20400?

CVE-2024-20400 is a medium-severity vulnerability in Cisco TelePresence Video Communication Server (VCS) Expressway, published on 17 Jul 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. This vulnerability is due to improper input validation of HTTP request parameters. An attacker could exploit this vulnerability by intercepting and modifying an HTTP request from a user. A successful exploit could allow the attacker to redirect the user to a malicious web page. Note: Cisco Expressway Series refers to Cisco Expressway Control (Expressway-C) devices and Cisco Expressway Edge (Expressway-E) devices.

Weakness: CWE-601

Which versions are affected by CVE-2024-20400?

It affects 1 product.

Products include Cisco Telepresence Video Communication Server.

How do I fix CVE-2024-20400?

No fix has been published for CVE-2024-20400 yet. Limit exposure of the affected software until one is available.

Is CVE-2024-20400 being exploited?

There is no known exploitation of CVE-2024-20400 in the wild and no public exploit code.

Sources

Also known as GHSA-cv3h-4jh6-rh6p.