Vulnerabilities > CVE-2021-1310 - Open Redirect vulnerability in Cisco Webex Meetings

CVSS 4.7 - MEDIUM

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

NONE

Integrity impact

LOW

Availability impact

NONE

network

low complexity

cisco

CWE-601

NVD

Published: 2021-01-13

Updated: 2024-04-11

Summary

A vulnerability in the web-based management interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to redirect a user to an untrusted web page, bypassing the warning mechanism that should prompt the user before the redirection. This vulnerability is due to improper input validation of the URL parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website, bypassing the Webex URL check that should result in a warning before the redirection to the web page. Attackers may use this type of vulnerability, known as an open redirect attack, as part of a phishing attack to convince users to unknowingly visit malicious sites.

Vulnerable Configurations

Part	Description	Count
Application	Cisco Cisco Webex Meetings - Cisco Webex Meetings 1.3.5 Cisco Webex Meetings 2.0 Cisco Webex Meetings 8.0_Base Cisco Webex Meetings 8.6 Cisco Webex Meetings 9.0 Cisco Webex Meetings 9.0.1 Cisco Webex Meetings 9.1 Cisco Webex Meetings 9.1.1 Cisco Webex Meetings 9.1.2 Cisco Webex Meetings 9.1.3 Cisco Webex Meetings 9.5 Cisco Webex Meetings 9.5.0 Cisco Webex Meetings 9.5.1 Cisco Webex Meetings 9.5.2 Cisco Webex Meetings 9.6 Cisco Webex Meetings 9.6.0 Cisco Webex Meetings 9.6.1 Cisco Webex Meetings 9.7.0 Cisco Webex Meetings 9.8 Cisco Webex Meetings 9.8.0 Cisco Webex Meetings 9.8.1 Cisco Webex Meetings 9.8.2 Cisco Webex Meetings 9.9.0 Cisco Webex Meetings 9.10.0 Cisco Webex Meetings 9.12.0 Cisco Webex Meetings 9.13.0 Cisco Webex Meetings 9.14.0 Cisco Webex Meetings 9.15.0 Cisco Webex Meetings 9.15.1 Cisco Webex Meetings 10.0 Cisco Webex Meetings 10.0.0 Cisco Webex Meetings 10.1 Cisco Webex Meetings 10.1.0 Cisco Webex Meetings 10.2 Cisco Webex Meetings 10.2.0 Cisco Webex Meetings 10.2.1 Cisco Webex Meetings 10.3 Cisco Webex Meetings 10.3.0 Cisco Webex Meetings 10.4 Cisco Webex Meetings 10.4.0 Cisco Webex Meetings 10.4.1 Cisco Webex Meetings 10.5 Cisco Webex Meetings 10.5.0 Cisco Webex Meetings 10.6 Cisco Webex Meetings 10.6.0 Cisco Webex Meetings 10.7 Cisco Webex Meetings 10.7.0 Cisco Webex Meetings 11.0 Cisco Webex Meetings 11.0.0 Cisco Webex Meetings 11.1 Cisco Webex Meetings 11.1.0 Cisco Webex Meetings 11.2 Cisco Webex Meetings 11.2.0 Cisco Webex Meetings 11.3 Cisco Webex Meetings 11.3.0 Cisco Webex Meetings 11.4 Cisco Webex Meetings 11.4.0 Cisco Webex Meetings 11.5 Cisco Webex Meetings 11.5.0 Cisco Webex Meetings 11.6 Cisco Webex Meetings 11.6.0 Cisco Webex Meetings 11.7 Cisco Webex Meetings 11.7.0 Cisco Webex Meetings 11.7.0.236 Cisco Webex Meetings 33.6.6 Cisco Webex Meetings 39.1.0 Cisco Webex Meetings 39.2.0 Cisco Webex Meetings 39.3.0 Cisco Webex Meetings 39.4.0 Cisco Webex Meetings 39.4.1 Cisco Webex Meetings 39.5 Cisco Webex Meetings 39.5.0 Cisco Webex Meetings 39.5.11 Cisco Webex Meetings 39.5.12 Cisco Webex Meetings 39.5.17 Cisco Webex Meetings 39.5.18 Cisco Webex Meetings 39.5.25 Cisco Webex Meetings 39.5.26 Cisco Webex Meetings 39.6 Cisco Webex Meetings 39.6.0 Cisco Webex Meetings 39.7 Cisco Webex Meetings 39.7.0 Cisco Webex Meetings 39.7.1 Cisco Webex Meetings 39.7.4 Cisco Webex Meetings 39.7.7 Cisco Webex Meetings 39.8 Cisco Webex Meetings 39.8.0 Cisco Webex Meetings 39.8.2 Cisco Webex Meetings 39.8.3 Cisco Webex Meetings 39.8.4 Cisco Webex Meetings 39.9 Cisco Webex Meetings 39.9.0 Cisco Webex Meetings 39.9.1 Cisco Webex Meetings 39.10 Cisco Webex Meetings 39.10.0 Cisco Webex Meetings 39.11 Cisco Webex Meetings 39.11.0 Cisco Webex Meetings 40.1 Cisco Webex Meetings 40.1.0 Cisco Webex Meetings 40.1.8.5 Cisco Webex Meetings 40.2 Cisco Webex Meetings 40.2.0 Cisco Webex Meetings 40.2.1 Cisco Webex Meetings 40.2.2 Cisco Webex Meetings 40.2.3 Cisco Webex Meetings 40.2.4 Cisco Webex Meetings 40.4 Cisco Webex Meetings 40.4.0 Cisco Webex Meetings 40.4.1 Cisco Webex Meetings 40.4.10 Cisco Webex Meetings 40.6 Cisco Webex Meetings 40.6.0 Cisco Webex Meetings 40.6.1 Cisco Webex Meetings 40.6.2 Cisco Webex Meetings 40.6.6 Cisco Webex Meetings 40.6.9 Cisco Webex Meetings 40.6.11 Cisco Webex Meetings 40.7.0 Cisco Webex Meetings 40.7.1 Cisco Webex Meetings 40.8.0 Cisco Webex Meetings 40.8.1 Cisco Webex Meetings 40.8.2 Cisco Webex Meetings 40.8.9 Cisco Webex Meetings 40.9.0 Cisco Webex Meetings 40.10 Cisco Webex Meetings 40.10.0 Cisco Webex Meetings 40.10.2 Cisco Webex Meetings 40.11.0	141

Common Weakness Enumeration (CWE)

CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')

Common Attack Pattern Enumeration and Classification (CAPEC)

Fake the Source of Data
An adversary provides data under a falsified identity. The purpose of using the falsified identity may be to prevent traceability of the provided data or it might be an attempt by the adversary to assume the rights granted to another identity. One of the simplest forms of this attack would be the creation of an email message with a modified "From" field in order to appear that the message was sent from someone other than the actual sender. Results of the attack vary depending on the details of the attack, but common results include privilege escalation, obfuscation of other attacks, and data corruption/manipulation.

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-open-redirect-PWvBQ2q