CVE-2018-15403

A vulnerability in the web interface of Cisco Emergency Responder, Cisco Unified Communications Manager, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an authenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by crafting an HTTP request that causes the web interface to redirect a request to a specific malicious URL. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites.

• CWE-601
• CWE-601

• http://www.securitytracker.com/id/1041780Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1041789Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-er-ucm-redirectVendor Advisory
• http://www.securitytracker.com/id/1041780Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1041789Third Party Advisory, VDB Entry
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-er-ucm-redirectVendor Advisory

Published

Oct 5, 2018

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-15397A vulnerability in the implementation of Traffic Flow Confid…6.8
• CVE-2018-15398A vulnerability in the per-user-override feature of Cisco Ad…4
• CVE-2018-15399A vulnerability in the TCP syslog module of Cisco Adaptive S…6.8
• CVE-2018-15400A vulnerability in the web-based management interface of Cis…
• CVE-2018-15401A vulnerability in the web-based management interface of Cis…
• CVE-2018-15402A vulnerability in Cisco Enterprise NFV Infrastructure Softw…5.4
• CVE-2018-15404A vulnerability in the web interface of Cisco Integrated Man…
• CVE-2018-15405A vulnerability in the web interface for specific feature se…6.5
• CVE-2018-15406A vulnerability in the web-based management interface of Cis…6.1
• CVE-2018-15407A vulnerability in the installation process of Cisco HyperFl…5.5
• CVE-2018-15408A vulnerability in the Cisco Webex Network Recording Player …
• CVE-2018-15409A vulnerability in the Cisco Webex Network Recording Player …