CVE-2021-1242
published 2021-01-13CVE-2021-1242: A vulnerability in Cisco Webex Teams could allow an unauthenticated, remote attacker to manipulate file names within the messaging interface. The vulnerability…
PriorityP423medium4.3CVSS 3.1
AVNACLPRNUIRSUCNILAN
EPSS
1.35%
68.3th percentile
A vulnerability in Cisco Webex Teams could allow an unauthenticated, remote attacker to manipulate file names within the messaging interface. The vulnerability exists because the affected software mishandles character rendering. An attacker could exploit this vulnerability by sharing a file within the application interface. A successful exploit could allow the attacker to modify how the shared file name displays within the interface, which could allow the attacker to conduct phishing or spoofing attacks.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apport_project | apport | >= 0 < 2.20.9-0ubuntu7.28 | 2.20.9-0ubuntu7.28 |
| apport_project | apport | >= 0 < 2.20.11-0ubuntu27.24 | 2.20.11-0ubuntu27.24 |
| apport_project | apport | >= 0 < 2.20.11-0ubuntu82.1 | 2.20.11-0ubuntu82.1 |
| apport_project | apport | >= 0 < 2.20.1-0ubuntu2.30+esm4 | 2.20.1-0ubuntu2.30+esm4 |
| cisco | cisco_webex_teams | — | — |
| cisco | jabber_and_webex | — | — |
| cisco | webex_teams | < 40.12.0.17293 | 40.12.0.17293 |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv7.8HIGH
vendor_cisco4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Jabber and Webex Client Software Shared File Manipulation Vulnerability
vendor_cisco·2021-01-13·CVSS 4.3
CVE-2021-1242 [MEDIUM] CWE-450 Cisco Jabber and Webex Client Software Shared File Manipulation Vulnerability
Cisco Jabber and Webex Client Software Shared File Manipulation Vulnerability
A vulnerability in Cisco Jabber and Cisco Webex (formerly Teams) could allow an unauthenticated, remote attacker to manipulate file names within the messaging interface.
The vulnerability exists because the affected software mishandles character rendering. An attacker could exploit this vulnerability by sharing a file within the application interface. A successful exploit could allow the attacker to modify how the shared file name displays within the interface, which could allow the attacker to conduct phishing or spoofing attacks.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:https:
Cisco
Cisco Jabber and Webex Client Software Shared File Manipulation Vulnerability
vendor_cisco·CVSS 3.1
CVE-2021-1242 Cisco Jabber and Webex Client Software Shared File Manipulation Vulnerability
CVE-2021-1242: Cisco Jabber and Webex Client Software Shared File Manipulation Vulnerability
A vulnerability in Cisco Jabber and Cisco Webex (formerly Teams) could allow an unauthenticated, remote attacker to manipulate file names within the messaging interface. The vulnerability exists because the affected software mishandles character rendering. An attacker could exploit this vulnerability by sharing a file within the application interface. A successful exploit could allow the attacker to modify how the shared file name displays within the interface, which could allow the attacker to conduct phishing or spoofing attacks. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.1
CWE: CWE-450, CWE-450
Bug IDs: CSCvv74842, CSCvy06013
OSV
apport vulnerabilities
osv·2024-07-11·CVSS 7.8
CVE-2021-3899 apport vulnerabilities
apport vulnerabilities
Muqing Liu and neoni discovered that Apport incorrectly handled detecting
if an executable was replaced after a crash. A local attacker could
possibly use this issue to execute arbitrary code as the root user.
(CVE-2021-3899)
Gerrit Venema discovered that Apport incorrectly handled connections to
Apport sockets inside containers. A local attacker could possibly use this
issue to connect to arbitrary sockets as the root user. (CVE-2022-1242)
Gerrit Venema discovered that Apport incorrectly handled user settings
files. A local attacker could possibly use this issue to cause Apport to
consume resources, leading to a denial of service. (CVE-2022-28652)
Gerrit Venema discovered that Apport did not limit the amount of logging
from D-Bus connections. A local attacker co
GHSA
GHSA-w44v-8fr4-v7gw: A vulnerability in Cisco Webex Teams could allow an unauthenticated, remote attacker to manipulate file names within the messaging interface
ghsa_unreviewed·2022-05-24
CVE-2021-1242 [MEDIUM] GHSA-w44v-8fr4-v7gw: A vulnerability in Cisco Webex Teams could allow an unauthenticated, remote attacker to manipulate file names within the messaging interface
A vulnerability in Cisco Webex Teams could allow an unauthenticated, remote attacker to manipulate file names within the messaging interface. The vulnerability exists because the affected software mishandles character rendering. An attacker could exploit this vulnerability by sharing a file within the application interface. A successful exploit could allow the attacker to modify how the shared file name displays within the interface, which could allow the attacker to conduct phishing or spoofing attacks.
OSV
apport vulnerabilities
osv·2022-05-17·CVSS 7.8
CVE-2021-3899 apport vulnerabilities
apport vulnerabilities
Muqing Liu and neoni discovered that Apport incorrectly handled detecting
if an executable was replaced after a crash. A local attacker could
possibly use this issue to execute arbitrary code as the root user.
(CVE-2021-3899)
Gerrit Venema discovered that Apport incorrectly handled connections to
Apport sockets inside containers. A local attacker could possibly use this
issue to connect to arbitrary sockets as the root user. (CVE-2022-1242)
Gerrit Venema discovered that Apport incorrectly handled user settings
files. A local attacker could possibly use this issue to cause Apport to
consume resources, leading to a denial of service. (CVE-2022-28652)
Gerrit Venema discovered that Apport did not limit the amount of logging
from D-Bus connections. A local attacker co
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-01-13
Published