CVE-2021-34743: Cisco Webex Software Application Authorization Bypass Vulnerability
A vulnerability in the application integration feature of Cisco Webex Software could allow an unauthenticated, remote attacker to authorize an external application to integrate with and access a user's account without that user's express consent. This vulnerability is due to improper validation of cross-site request forgery (CSRF) tokens. An attacker could exploit this vulnerability by convincing a targeted user who is currently authenticated to Cisco Webex Software to follow a link designed to pass malicious input to the Cisco Webex Software application authorization interface. A successful exploit could allow the attacker to cause Cisco Webex Software to authorize an application on the user's behalf without the express consent of the user, possibly allowing external applications to read data from that user's profile.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Cisco Webex Software vulnerability?
The vulnerability ID for this Cisco Webex Software vulnerability is CVE-2021-34743.
What is the severity rating of CVE-2021-34743?
The severity rating of CVE-2021-34743 is high, with a severity value of 7.1.
How can an unauthenticated, remote attacker exploit CVE-2021-34743?
An unauthenticated, remote attacker can exploit CVE-2021-34743 by authorizing an external application to integrate with and access a user's account without their express consent.
Which Cisco Webex Software version is affected by CVE-2021-34743?
Cisco Webex Meetings is affected by CVE-2021-34743.
Is there a fix available for CVE-2021-34743?
Yes, Cisco has released a security advisory with mitigation details for CVE-2021-34743. Please refer to the provided reference for more information.