cisco-sa-webex-activation-3sdNFxcy: Cisco Webex Meetings Email Content Injection Vulnerability
First published: Wed Nov 03 2021(Updated: )
A vulnerability in the account activation feature of Cisco Webex Meetings could allow an unauthenticated, remote attacker to send an account activation email with an activation link that points to an arbitrary domain. This vulnerability is due to insufficient validation of user-supplied parameters. An attacker could exploit this vulnerability by sending a crafted HTTP request to the account activation page of Cisco Webex Meetings. A successful exploit could allow the attacker to send to any recipient an account activation email that contains a tampered activation link, which could direct the user to an attacker-controlled website. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-activation-3sdNFxcy
Credit: the security researcher Prasenjit Kanti Paul.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Webex Meetings Client |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of Cisco-SA-Webex-Activation-3sdNFxcy?
The severity of Cisco-SA-Webex-Activation-3sdNFxcy is considered to be high due to the potential risk of account takeover.
How do I fix Cisco-SA-Webex-Activation-3sdNFxcy?
To fix Cisco-SA-Webex-Activation-3sdNFxcy, ensure that you apply the latest updates from Cisco for Webex Meetings.
What type of attack is possible with Cisco-SA-Webex-Activation-3sdNFxcy?
Cisco-SA-Webex-Activation-3sdNFxcy allows an unauthenticated attacker to send misleading activation emails pointing to arbitrary domains.
Is my version of Cisco Webex Meetings affected by Cisco-SA-Webex-Activation-3sdNFxcy?
Any version of Cisco Webex Meetings that utilizes the account activation feature is potentially affected by Cisco-SA-Webex-Activation-3sdNFxcy.
What should users of Cisco Webex Meetings do regarding Cisco-SA-Webex-Activation-3sdNFxcy?
Users of Cisco Webex Meetings should regularly check for and apply security updates to mitigate risks associated with Cisco-SA-Webex-Activation-3sdNFxcy.
- agent/type
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- collector/cisco-advisory
- source/Cisco
- agent/author
- agent/weakness
- agent/references
- agent/title
- agent/severity
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco webex meetings client