Vulnerabilities > CVE-2021-1544 - Exposure of System Data to an Unauthorized Control Sphere vulnerability in Cisco Webex Meetings

CVSS 5.5 - MEDIUM

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

HIGH

Integrity impact

NONE

Availability impact

NONE

local

low complexity

cisco

CWE-497

NVD

Published: 2021-06-04

Updated: 2023-11-07

Summary

A vulnerability in logging mechanisms of Cisco Webex Meetings client software could allow an authenticated, local attacker to gain access to sensitive information. This vulnerability is due to unsafe logging of application actions. An attacker could exploit this vulnerability by logging onto the local system and accessing files containing the logged details. A successful exploit could allow the attacker to gain access to sensitive information, including meeting data and recorded meeting transcriptions.

Vulnerable Configurations

Part	Description	Count
Application	Cisco Cisco Webex Meetings - Cisco Webex Meetings 1.3.5 Cisco Webex Meetings 2.0 Cisco Webex Meetings 8.0_Base Cisco Webex Meetings 9.5 Cisco Webex Meetings 9.6 Cisco Webex Meetings 9.8 Cisco Webex Meetings 10.0 Cisco Webex Meetings 10.1 Cisco Webex Meetings 10.2 Cisco Webex Meetings 10.3 Cisco Webex Meetings 10.4 Cisco Webex Meetings 10.5 Cisco Webex Meetings 10.6 Cisco Webex Meetings 10.7 Cisco Webex Meetings 11.0 Cisco Webex Meetings 11.1 Cisco Webex Meetings 11.2 Cisco Webex Meetings 11.3 Cisco Webex Meetings 11.4 Cisco Webex Meetings 11.5 Cisco Webex Meetings 11.6 Cisco Webex Meetings 11.7 Cisco Webex Meetings 11.7.0.236 Cisco Webex Meetings 33.6.6 Cisco Webex Meetings 39.5 Cisco Webex Meetings 39.5.11 Cisco Webex Meetings 39.5.12 Cisco Webex Meetings 39.5.17 Cisco Webex Meetings 39.5.18 Cisco Webex Meetings 39.5.25 Cisco Webex Meetings 39.5.26 Cisco Webex Meetings 39.6 Cisco Webex Meetings 39.6.0 Cisco Webex Meetings 39.7 Cisco Webex Meetings 39.7.0 Cisco Webex Meetings 39.7.4 Cisco Webex Meetings 39.7.7 Cisco Webex Meetings 39.8 Cisco Webex Meetings 39.8.0 Cisco Webex Meetings 39.8.2 Cisco Webex Meetings 39.8.3 Cisco Webex Meetings 39.8.4 Cisco Webex Meetings 39.9 Cisco Webex Meetings 39.9.0 Cisco Webex Meetings 39.9.1 Cisco Webex Meetings 39.10 Cisco Webex Meetings 39.10.0 Cisco Webex Meetings 39.11 Cisco Webex Meetings 39.11.0 Cisco Webex Meetings 40.1 Cisco Webex Meetings 40.1.0 Cisco Webex Meetings 40.1.8.5 Cisco Webex Meetings 40.2 Cisco Webex Meetings 40.2.0 Cisco Webex Meetings 40.4 Cisco Webex Meetings 40.4.0 Cisco Webex Meetings 40.4.10 Cisco Webex Meetings 40.6 Cisco Webex Meetings 40.6.0 Cisco Webex Meetings 40.6.2 Cisco Webex Meetings 40.6.6 Cisco Webex Meetings 40.6.9 Cisco Webex Meetings 40.6.11 Cisco Webex Meetings 40.7.0 Cisco Webex Meetings 40.8.0 Cisco Webex Meetings 40.8.9 Cisco Webex Meetings 40.10 Cisco Webex Meetings 40.10.2 Cisco Webex Meetings 40.11.3 Cisco Webex Meetings 41.1.0	83

Common Weakness Enumeration (CWE)

CWE-497 - Exposure of System Data to an Unauthorized Control Sphere

Common Attack Pattern Enumeration and Classification (CAPEC)

Footprinting
An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.

References

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-8fpBnKOz