CVE-2021-1310
published 2021-01-13CVE-2021-1310: A vulnerability in the web-based management interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to redirect a user to an…
PriorityP423medium4.7CVSS 3.1
AVNACLPRNUIRSCCNILAN
EPSS
1.58%
72.7th percentile
A vulnerability in the web-based management interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to redirect a user to an untrusted web page, bypassing the warning mechanism that should prompt the user before the redirection. This vulnerability is due to improper input validation of the URL parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website, bypassing the Webex URL check that should result in a warning before the redirection to the web page. Attackers may use this type of vulnerability, known as an open redirect attack, as part of a phishing attack to convince users to unknowingly visit malicious sites.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_webex_meetings | — | — |
| cisco | webex_meetings | < 40.11.1 | 40.11.1 |
| cisco | webex_meetings_open_redirect | — | — |
| chrome_chrome | — | — |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_cisco4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Chrome
Stable Channel Update for Desktop: CVE-2022-1308
vendor_chrome·2022-04-11·CVSS 8.8
CVE-2022-1308 [HIGH] Stable Channel Update for Desktop: CVE-2022-1308
Stable Channel Update for Desktop
CVE-2022-1308: Use after free in BFCache. Reported by Samet Bekmezci @sametbekmezci on 2021-12-28 [$TBD][ 1106456 ] High CVE-2022-1309: Insufficient policy enforcement in developer tools
Reported by David Erceg on 2020-07-17 [$TBD][ 1307610 ] High CVE-2022-1310: Use after free in regular expressions
Severity: high
Cisco
Cisco Webex Meetings Open Redirect Vulnerability
vendor_cisco·2021-01-13·CVSS 4.7
CVE-2021-1310 [MEDIUM] CWE-601 Cisco Webex Meetings Open Redirect Vulnerability
Cisco Webex Meetings Open Redirect Vulnerability
A vulnerability in the web-based management interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to redirect a user to an untrusted web page, bypassing the warning mechanism that should prompt the user before the redirection.
This vulnerability is due to improper input validation of the URL parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website, bypassing the Webex URL check that should result in a warning before the redirection to the web page. Attackers may use this type of vulnerability, known as an open redirect attack, as part of a phishing attack to con
Cisco
Cisco Webex Meetings Open Redirect Vulnerability
vendor_cisco·CVSS 3.1
CVE-2021-1310 Cisco Webex Meetings Open Redirect Vulnerability
CVE-2021-1310: Cisco Webex Meetings Open Redirect Vulnerability
A vulnerability in the web-based management interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to redirect a user to an untrusted web page, bypassing the warning mechanism that should prompt the user before the redirection. This vulnerability is due to improper input validation of the URL parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website, bypassing the Webex URL check that should result in a warning before the redirection to the web page. Attackers may use this type of vulnerability, known as an open redirect attack, as part of a phishing
GHSA
GHSA-mhr4-7h64-3vv5: A vulnerability in the web-based management interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to redirect a user to an
ghsa_unreviewed·2022-05-24
CVE-2021-1310 [MEDIUM] CWE-601 GHSA-mhr4-7h64-3vv5: A vulnerability in the web-based management interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to redirect a user to an
A vulnerability in the web-based management interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to redirect a user to an untrusted web page, bypassing the warning mechanism that should prompt the user before the redirection. This vulnerability is due to improper input validation of the URL parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website, bypassing the Webex URL check that should result in a warning before the redirection to the web page. Attackers may use this type of vulnerability, known as an open redirect attack, as part of a phishing attack to convince users to unknowingly visit malicious sites.
No detection rules found.
No public exploits indexed.
2021-01-13
Published