CVE-2021-1410: Cisco Webex Meetings Unauthorized Distribution List Update Vulnerability
First published: Mon Nov 18 2024(Updated: )
A vulnerability in the distribution list feature of Cisco Webex Meetings could allow an authenticated, remote attacker to modify a distribution list that belongs to another user of their organization. The vulnerability is due to insufficient authorization enforcement for requests to update distribution lists. An attacker could exploit this vulnerability by sending a crafted request to the Webex Meetings interface to modify an existing distribution list. A successful exploit could allow the attacker to modify a distribution list that belongs to a user other than themselves.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Webex Meetings Client |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-1410?
CVE-2021-1410 is considered a medium severity vulnerability due to potential unauthorized access risks within organizations.
How do I fix CVE-2021-1410?
To mitigate CVE-2021-1410, ensure that users are updated to the latest version of Cisco Webex Meetings which contains the necessary security patches.
Who is affected by CVE-2021-1410?
CVE-2021-1410 affects organizations using Cisco Webex Meetings where users can manage distribution lists.
What type of vulnerability is CVE-2021-1410?
CVE-2021-1410 is an authorization bypass vulnerability that allows modification of distribution lists by unauthorized users.
Can CVE-2021-1410 be exploited remotely?
Yes, CVE-2021-1410 can be exploited by authenticated remote attackers to modify distribution lists of other users.
- agent/references
- agent/title
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- collector/mitre-cve
- source/MITRE
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco webex meetings client