Vulnerability · Published Feb 4, 2021 · Assigned by cisco
CVE-2021-1221Cisco Webex Meetings and Cisco Webex Meetings Server Software Hyperlink Injection Vulnerability
Medium 4.1
In plain English
A medium-severity improper input validation in Cisco WebEx Meetings Server from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities).
Official description
A vulnerability in the user interface of Cisco Webex Meetings and Cisco Webex Meetings Server Software could allow an authenticated, remote attacker to inject a hyperlink into a meeting invitation email. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by entering a URL into a field in the user interface. A successful exploit could allow the attacker to generate a Webex Meetings invitation email that contains a link to a destination of their choosing. Because this email is sent from a trusted source, the recipient may be more likely to click the link.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco WebEx Meetings Server | n/a |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
References
- 20210203 Cisco Webex Meetings and Cisco Webex Meetings Server Software Hyperlink Injection Vulnerability vendor-advisory, x_refsource_CISCO