PT-2021-7449 · Cisco · Cisco Webex Meetings Server+1

Alexandros Zacharis · Published 2021-06-02 · Updated 2021-06-14 · CVE-2021-1525

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Webex Meetings and Cisco Webex Meetings Server (affected versions not specified)

Description The issue is related to improper validation of URL paths in the application interface, allowing an unauthenticated, remote attacker to redirect users to a malicious file. This could be achieved by persuading a user to follow a specially crafted URL, enabling the attacker to include a remote file in the web UI. A successful exploit could allow the attacker to conduct further phishing or spoofing attacks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2022-06347

CVE-2021-1525

Affected Products

Cisco Webex Meetings

Cisco Webex Meetings Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2021-1525 · Security Note
• https://osv.dev/vulnerability/CVE-2021-1525 · Vendor Advisory
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-redirect-XuZFU3PH · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-06347 · Security Note
• https://t.me/cvenotify/16287 · Telegram Post