Cisco Webex Meetings Unauthorized Distribution List Update Vulnerability (Cisco Cisco Webex Meetings)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.83 % · percentile 58 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- cisco
- NVD status
- Analyzed
Description
A vulnerability in the distribution list feature of Cisco Webex Meetings could allow an authenticated, remote attacker to modify a distribution list that belongs to another user of their organization. The vulnerability is due to insufficient authorization enforcement for requests to update distribution lists. An attacker could exploit this vulnerability by sending a crafted request to the Webex Meetings interface to modify an existing distribution list. A successful exploit could allow the attacker to modify a distribution list that belongs to a user other than themselves.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Weaknesses (CWE)
- CWE-284 — Improper Access Control
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/RL:X/RC:X/E:X | cisco |
| CVSS 3.1 | MEDIUM 4.3 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N | NVD · psirt@cisco.com (Secondary) |
European references
- ENISA EUVD · EUVD-2021-6877
- GCVE · GCVE-0-2021-1410
Affected configurations (NVD CPE)
cpe:2.3:a:cisco:webex_meetings:39.6:*:*:*:*:*:*:*cpe:2.3:a:cisco:webex_meetings:39.7:*:*:*:*:*:*:*cpe:2.3:a:cisco:webex_meetings:39.7.4:*:*:*:*:*:*:*cpe:2.3:a:cisco:webex_meetings:39.7.7:*:*:*:*:*:*:*cpe:2.3:a:cisco:webex_meetings:39.8:*:*:*:*:*:*:*cpe:2.3:a:cisco:webex_meetings:39.8.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:webex_meetings:39.8.3:*:*:*:*:*:*:*cpe:2.3:a:cisco:webex_meetings:39.8.4:*:*:*:*:*:*:*cpe:2.3:a:cisco:webex_meetings:39.9:*:*:*:*:*:*:*cpe:2.3:a:cisco:webex_meetings:39.9.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:webex_meetings:39.10:*:*:*:*:*:*:*cpe:2.3:a:cisco:webex_meetings:39.11:*:*:*:*:*:*:*cpe:2.3:a:cisco:webex_meetings:40.1:*:*:*:*:*:*:*cpe:2.3:a:cisco:webex_meetings:40.2:*:*:*:*:*:*:*cpe:2.3:a:cisco:webex_meetings:40.4:*:*:*:*:*:*:*cpe:2.3:a:cisco:webex_meetings:40.4.10:*:*:*:*:*:*:*cpe:2.3:a:cisco:webex_meetings:40.6:*:*:*:*:*:*:*cpe:2.3:a:cisco:webex_meetings:40.6.2:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Cisco · Cisco Webex Meetings | affected 39.7.7 ; affected 39.9 ; affected 40.4.10 ; affected 39.6 ; affected 40.6.2 ; affected 39.8.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |