Main Vulnerability Database Vulnerabilities #VU50317

Input validation error in Cisco WebEx Meetings Server and Cisco Webex Meetings - CVE-2021-1221

Published: February 4, 2021

Vulnerability identifier: #VU50317

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-1221

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to inject a hyperlink into a meeting invitation email.

The vulnerability exists due to insufficient validation of user-supplied input in the user interface. A remote authenticated attacker can generate a Webex Meetings invitation email that contains a link to a destination of their choosing.

Affected software

Cisco WebEx Meetings Server
Cisco Webex Meetings

How to mitigate CVE-2021-1221

Install updates from vendor's website.

Cisco WebEx Meetings Server - addressed in versions 3.0MR3 Patch 5, 4.0MR3 Patch 4
Cisco Webex Meetings - update to 41.1.0.17621

External References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wbx-linkinj-WWZpVqu9

Related Security Bulletins