CVE-2017-6670

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based GUI of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote attacker to redirect a user to a malicious web page, aka an Open Redirect issue. More Information: CSCvc54813. Known Affected Releases: 8.1(7)ER1.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
n/a	Cisco Unified Communications Domain Manager	Cisco Unified Communications Domain Manager

References

http://www.securityfocus.com/bid/98946Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038631
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-cucm1Vendor Advisory
http://www.securityfocus.com/bid/98946Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038631
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170607-cucm1Vendor Advisory

Timeline

Published: Jun 13, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-66717.5A vulnerability in the email message scanning of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthentica CVE-2017-66727.5A vulnerability in certain filtering mechanisms of access control lists (ACLs) for Cisco ASR 5000 Series Aggregation Services Routers throug CVE-2017-66736.5A vulnerability in Cisco Firepower Management Center could allow an authenticated, remote attacker to obtain user information. An attacker c CVE-2017-66747.5A vulnerability in the feature-license management functionality of Cisco Firepower System Software could allow an unauthenticated, remote at CVE-2017-66756.1A vulnerability in the web interface of Cisco Industrial Network Director could allow an unauthenticated, remote attacker to conduct a refle CVE-2017-66787.5A vulnerability in the ingress UDP packet processing functionality of Cisco Virtualized Packet Core-Distributed Instance (VPC-DI) Software 1 CVE-2017-66796.4The Cisco Umbrella Virtual Appliance Version 2.0.3 and prior contained an undocumented encrypted remote support tunnel (SSH) which auto init CVE-2017-66807.5A vulnerability in the AutoVNF logging function of Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to create CVE-2017-66817.5A vulnerability in the AutoVNF VNFStagingView class of Cisco Ultra Services Framework could allow an unauthenticated, remote attacker to exe CVE-2017-66828.8A vulnerability in the ConfD CLI of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to run arbitrary comman CVE-2017-66838.8A vulnerability in the esc_listener.py script of Cisco Elastic Services Controllers could allow an authenticated, remote attacker to execute CVE-2017-66848.8A vulnerability in Cisco Elastic Services Controllers could allow an authenticated, remote attacker to log in to an affected system as the L