Cisco Catalyst Center Virtual Appliance HTTP Open Redirect Vulnerability

A vulnerability exists in the web-based management interface of Cisco Catalyst Center Virtual Appliance on VMware ESXi. It allows an unauthenticated, remote attacker to redirect users to malicious web pages. This issue arises from improper input validation of HTTP request parameters, enabling attackers to intercept and modify requests to facilitate the redirection.

Impact

Exploitation of this vulnerability could lead to unauthorized redirection of users to malicious websites, potentially causing harm depending on the nature of the malicious site.

Remediation

Users are advised to upgrade to Cisco Catalyst Center version 2.3.7.10-VA or later. For versions 3.1, this vulnerability is not applicable. Instructions for obtaining the update can be found on the Cisco Support and Downloads page.