What is the vulnerability ID for this Cisco Webex vulnerability?

The vulnerability ID for this Cisco Webex vulnerability is CVE-2021-1372.

What is the severity of CVE-2021-1372?

The severity of CVE-2021-1372 is medium with a CVSS score of 5.5.

What is the affected software for CVE-2021-1372?

The affected software for CVE-2021-1372 includes Cisco Webex Meetings Desktop App, Webex Productivity Tools for Windows, and Cisco WebEx Meetings Server.

How can an attacker exploit CVE-2021-1372?

An attacker can exploit CVE-2021-1372 by using unsafe shared memory to gain access to sensitive information on an affected system.

Is there a fix available for CVE-2021-1372?

Yes, Cisco has released a security advisory with fixes and mitigations for CVE-2021-1372.

Vulnerability/
CVE-2021-1372

medium

5.5

CWE

202

17/2/2021

8/11/2024

CVE-2021-1372: Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows Shared Memory Information Disclosure Vulnerability

First published: Wed Feb 17 2021(Updated: )

A vulnerability in Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows could allow an authenticated, local attacker to gain access to sensitive information on an affected system. This vulnerability is due to the unsafe usage of shared memory by the affected software. An attacker with permissions to view system memory could exploit this vulnerability by running an application on the local system that is designed to read shared memory. A successful exploit could allow the attacker to retrieve sensitive information from the shared memory, including usernames, meeting information, or authentication tokens. Note: To exploit this vulnerability, an attacker must have valid credentials on a Microsoft Windows end-user system and must log in after another user has already authenticated with Webex on the same end-user system.

Credit: ykramarz@cisco.com

Affected Software	Affected Version	How to fix
Cisco Webex Meetings	<40.6
Cisco Webex Meetings	<40.10
Cisco WebEx Meetings Server	<4.0
Cisco WebEx Meetings Server	=4.0
Cisco WebEx Meetings Server	=4.0-maintenance_release1
Cisco WebEx Meetings Server	=4.0-maintenance_release2
Cisco WebEx Meetings Server	=4.0-maintenance_release3
Cisco WebEx Meetings Server	=4.0-maintenance_release3_security_patch3

Never miss a vulnerability like this again

Reference Links

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-wda-pt-msh-6LWOcZ5

Frequently Asked Questions

What is the vulnerability ID for this Cisco Webex vulnerability?
The vulnerability ID for this Cisco Webex vulnerability is CVE-2021-1372.
What is the severity of CVE-2021-1372?
The severity of CVE-2021-1372 is medium with a CVSS score of 5.5.
What is the affected software for CVE-2021-1372?
The affected software for CVE-2021-1372 includes Cisco Webex Meetings Desktop App, Webex Productivity Tools for Windows, and Cisco WebEx Meetings Server.
How can an attacker exploit CVE-2021-1372?
An attacker can exploit CVE-2021-1372 by using unsafe shared memory to gain access to sensitive information on an affected system.
Is there a fix available for CVE-2021-1372?
Yes, Cisco has released a security advisory with fixes and mitigations for CVE-2021-1372.

collector/nvd-index
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/author
agent/references
agent/last-modified-date
agent/title
agent/weakness
agent/severity
agent/tags
agent/description
agent/first-publish-date
agent/event
vendor/cisco
canonical/cisco webex meetings
canonical/cisco webex meetings server
version/cisco webex meetings server/4.0
version/cisco webex meetings server/4.0-maintenance_release1
version/cisco webex meetings server/4.0-maintenance_release2
version/cisco webex meetings server/4.0-maintenance_release3
version/cisco webex meetings server/4.0-maintenance_release3_security_patch3