VDB
CVE-2019-1943
CVE-2019-1943
PUBLISHED
CVSS 4.699999809265137 MEDIUM
A vulnerability in the web interface of Cisco Small Business 200, 300, and 500 Series Switches software could allow an unauthenticated, remote attacker to redirect a user to a malicious web page. The vulnerability is due to improper input validation of the parameters of an HTTP request. An attacker could exploit this vulnerability by intercepting a user's HTTP request and modifying it into a request that causes the web interface to redirect the user to a specific malicious URL. This type of vulnerability is known as an open redirect attack and is used in phishing attacks that get users to unknowingly visit malicious sites.
EPSS 9.69% · 95.2th percentile
Risk Scores
CVSS 3.0
4.699999809265137
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score
9.69%
95.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| cisco | sg200-18_firmware | |
| cisco | sf300-24mp_firmware | 1.3.7.18 |
| cisco | sf200-24p_firmware | |
| cisco | sg300-28pp_firmware | 1.3.7.18 |
| cisco | sf200-24fp_firmware | |
| cisco | sf302-08mpp_firmware | 1.3.7.18 |
| cisco | sf300-24pp_firmware | 1.3.7.18 |
| cisco | sg300-28mp_firmware | 1.3.7.18 |
| cisco | sg300-20_firmware | 1.3.7.18 |
| cisco | sf300-48p_firmware | 1.3.7.18 |
| cisco | sg500-28_firmware | |
| cisco | sf200-48_firmware | |
| cisco | sf300-08_firmware | 1.3.7.18 |
| cisco | sf500-24_firmware | |
| cisco | sg500-28p_firmware | |
| cisco | sg300-52_firmware | 1.3.7.18 |
| cisco | sg300-10_firmware | 1.3.7.18 |
| cisco | sf300-24_firmware | 1.3.7.18 |
| cisco | sg500x-48p_firmware | |
| cisco | sf302-08mp_firmware | 1.3.7.18 |
…and 38 more
Timeline
- Jul 15, 2019 CVE Published
- Jul 15, 2019 PoC Published
- Apr 14, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Dec 28, 2021 EPSS Score
- Feb 4, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- Jul 4, 2022 EPSS Score
- Nov 7, 2022 EPSS Score
- Mar 7, 2023 EPSS Score
- May 14, 2023 EPSS Score
- Jun 6, 2023 EPSS Score