CVE-2019-1954— Cisco Webex Meetings Server Open Redirection Vulnerability
Quick assessment
Affected
Cisco Cisco WebEx Meetings Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cisco WebEx Meetings Server（CWMS）是WebEx会议方案中的一套包含音频、视频和Web会议的多功能会议解决方案。 Cisco CWMS 4.0(1)之前版本中的Web管理界面存在输入验证错误漏洞，该漏洞源于程序没有对HTTP请求中的URL参数执行正确的输入验证。远程攻击者可通过发送HTTP请求利用该漏洞将用户重定向恶意的网站。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2019-1954
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco Webex Meetings Server Open Redirection Vulnerability
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability in the web-based management interface of Cisco Webex Meetings Server Software could allow an unauthenticated, remote attacker to redirect a user to an undesired web page. The vulnerability is due to improper input validation of the URL parameters in an HTTP request that is sent to an affected device. An attacker could exploit this vulnerability by crafting an HTTP request that could cause the web application to redirect the request to a specified malicious URL. A successful exploit could allow the attacker to redirect a user to a malicious website.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: CVE Program / CVE List V5
Vulnerability Title
Cisco WebEx Meetings Server 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco WebEx Meetings Server（CWMS）是WebEx会议方案中的一套包含音频、视频和Web会议的多功能会议解决方案。 Cisco CWMS 4.0(1)之前版本中的Web管理界面存在输入验证错误漏洞，该漏洞源于程序没有对HTTP请求中的URL参数执行正确的输入验证。远程攻击者可通过发送HTTP请求利用该漏洞将用户重定向恶意的网站。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco WebEx Meetings Server | unspecified ~ 4.0(1) | - |
|
II. Public POCs for CVE-2019-1954
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2019-1954
请登录查看更多情报信息。
Vendor Advisories for CVE-2019-1954 (1)
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190807-wms-oredirect vendor-advisory x_refsource_CISCO
Same Patch Batch · Cisco · 2019-08-08 · 17 CVEs total
| CVE-2019-1973 | Cisco Enterprise NFV Infrastructure Software Cross-site Scripting Vulnerability | |
| CVE-2019-1959 | Cisco Enterprise NFV Infrastructure Software Arbitrary File Read Vulnerabilities | |
| CVE-2019-1960 | Cisco Enterprise NFV Infrastructure Software Arbitrary File Read Vulnerabilities | |
| CVE-2019-1961 | Cisco Enterprise NFV Infrastructure Software Web Portal Arbitrary File Read Vulnerability | |
| CVE-2019-1970 | Cisco Firepower Threat Defense Software File Policy Bypass Vulnerability | |
| CVE-2019-1971 | Cisco Enterprise NFV Infrastructure Software Command Injection Vulnerability | |
| CVE-2019-1972 | Cisco Enterprise NFV Infrastructure Software Privilege Escalation Vulnerability | |
| CVE-2019-1953 | Cisco Enterprise NFV Infrastructure Software Password Recovery Vulnerability | |
| CVE-2019-1955 | Cisco Email Security Appliance Header Injection Vulnerability | |
| CVE-2019-1956 | Cisco SPA112 2-Port Phone Adapter Stored Cross-Site Scripting Vulnerability | |
| CVE-2019-1957 | Cisco IoT Field Network Director TLS Renegotiation Denial of Service Vulnerability | |
| CVE-2019-1958 | Cisco HyperFlex Software Cross-Site Request Forgery Vulnerability | |
| CVE-2019-1949 | Cisco Firepower Management Center Persistent Cross-Site Scripting Vulnerability | |
| CVE-2019-1951 | Cisco SD-WAN Solution Packet Filtering Bypass Vulnerability | |
| CVE-2019-1952 | Cisco Enterprise NFV Infrastructure Software Path Traversal Vulnerability | |
| CVE-2019-1946 | Cisco Enterprise NFV Infrastructure Software Web-Based Management Interface Authentication |
IV. Related Vulnerabilities
Same product: Cisco WebEx Meetings Server
-
CVE-2021-1525
Cisco Webex Meetings and Webex Meetings Server File Redirect -
CVE-2021-1517
Cisco Webex Meetings and Webex Meetings Server Multimedia Sh -
CVE-2021-1221
Cisco Webex Meetings and Cisco Webex Meetings Server Softwar -
CVE-2021-1311
Cisco Webex Meetings and Cisco Webex Meetings Server Host K -
CVE-2020-3471
Cisco Webex Meetings and Cisco Webex Meetings Server Unautho
Same vendor: Cisco
-
CVE-2026-76504
Cisco Catalyst SD-WAN Manager System Account Authorization B -
CVE-2026-76426
Cisco ISE REST API SQL Injection Vulnerability -
CVE-2026-20121
CIsco FTD Bypass Access List -
CVE-2026-76431
Cisco Identity Services Engine Arbitrary File Deletion Vulne -
CVE-2026-76427
Cisco ISE XML External Entity Injection Vulnerability
Same weakness: CWE-601
-
CVE-2026-103048
Open Redirect in Special:Book -
CVE-2026-53989
Dockhand < 1.0.36 Open Redirect via OIDC Initiation Endpoint -
CVE-2026-73599
Dell Secure Connect Gateway <5.34.00.16 开放重定向漏洞 -
CVE-2026-76720
HPE OneView - URL Redirect vulnerability -
CVE-2026-101090
Nezha through 2.2.3 Host Header Injection via OAuth2 redirec
V. Comments for CVE-2019-1954
No comments yet