PT-2021-2166 · Cisco+1 · Webex Productivity Tools+2

Published 2021-02-17 · Updated 2021-02-23 · CVE-2021-1372

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Webex Meetings Desktop App and Webex Productivity Tools (affected versions not specified)

Description The issue is related to errors in processing requests in the Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows, allowing an attacker to gain unauthorized access to protected information by running a specially designed application. This vulnerability is due to the unsafe usage of shared memory by the affected software. An attacker with permissions to view system memory could exploit this vulnerability, potentially retrieving sensitive information from the shared memory, including usernames, meeting information, or authentication tokens. To exploit this vulnerability, an attacker must have valid credentials on a Microsoft Windows end-user system and must log in after another user has already authenticated with Webex on the same end-user system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-202

Related Identifiers

BDU:2021-01060

CVE-2021-1372

Affected Products

Cisco Webex Meetings Desktop App

Windows

Webex Productivity Tools

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-1372 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1372 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wda-pt-msh-6LWOcZ5 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01060 · Security Note
• https://t.me/cibsecurity/23762 · Telegram Post