A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to redirect users to a malicious file. This vulnerability is due to improper validation of URL paths in the application interface. An attacker could exploit this vulnerability by persuading a user to follow a specially crafted URL that is designed to cause Cisco Webex Meetings to include a remote file in the web UI. A successful exploit could allow the attacker to cause the application to offer a remote file to a user, which could allow the attacker to conduct further phishing or spoofing attacks.
References
| Link | Resource |
|---|---|
| https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-redirect-XuZFU3PH | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
14 Jun 2021, 18:58
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-601 | |
| CVSS |
v2 : v3 : |
v2 : 5.8
v3 : 6.1 |
| References | (CISCO) https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-redirect-XuZFU3PH - Vendor Advisory | |
| CPE | cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3:*:*:*:*:*:* cpe:2.3:a:cisco:webex_meetings_server:4.0:-:*:*:*:*:*:* cpe:2.3:a:cisco:webex_meetings_server:4.0:maintenance_release3_security_patch4:*:*:*:*:*:* cpe:2.3:a:cisco:webex_meetings_server:4.0:maintenance_release1:*:*:*:*:*:* cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release1:*:*:*:*:*:* cpe:2.3:a:cisco:webex_meetings_server:*:*:*:*:*:*:*:* cpe:2.3:a:cisco:webex_meetings_server:4.0:maintenance_release2:*:*:*:*:*:* cpe:2.3:a:cisco:webex_meetings_server:4.0:maintenance_release3:*:*:*:*:*:* cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release2:*:*:*:*:*:* cpe:2.3:a:cisco:webex_meetings_online:41.3.5:*:*:*:*:*:*:* cpe:2.3:a:cisco:webex_meetings_server:3.0:-:*:*:*:*:*:* cpe:2.3:a:cisco:webex_meetings_server:4.0:maintenance_release3_security_patch3:*:*:*:*:*:* |
04 Jun 2021, 17:59
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-06-04 17:15
Updated : 2023-12-10 13:55
NVD link : CVE-2021-1525
Mitre link : CVE-2021-1525
CVE.ORG link : CVE-2021-1525
JSON object : View
Products Affected
cisco
- webex_meetings_online
- webex_meetings_server
CWE
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')