CVE-2021-1372
published 2021-02-17CVE-2021-1372: A vulnerability in Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows could allow an authenticated, local attacker to gain access to…
PriorityP425medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.41%
33.0th percentile
A vulnerability in Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows could allow an authenticated, local attacker to gain access to sensitive information on an affected system. This vulnerability is due to the unsafe usage of shared memory by the affected software. An attacker with permissions to view system memory could exploit this vulnerability by running an application on the local system that is designed to read shared memory. A successful exploit could allow the attacker to retrieve sensitive information from the shared memory, including usernames, meeting information, or authentication tokens. Note: To exploit this vulnerability, an attacker must have valid credentials on a Microsoft Windows end-user system and must log in after another user has already authenticated with Webex on the same end-user system.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_webex_productivity_tools | — | — |
| cisco | webex_meetings | < 40.6 | 40.6 |
| cisco | webex_meetings | < 40.10 | 40.10 |
| cisco | webex_meetings_desktop_app_and_webex_productivity_tools_for_windows_shared | — | — |
| cisco | webex_meetings_server | < 4.0 | 4.0 |
| cisco | webex_meetings_server | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
vendor_cisco5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows Shared Memory Information Disclosure Vulnerability
vendor_cisco·2021-02-17·CVSS 5.5
CVE-2021-1372 [MEDIUM] CWE-202 Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows Shared Memory Information Disclosure Vulnerability
Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows Shared Memory Information Disclosure Vulnerability
A vulnerability in Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows could allow an authenticated, local attacker to gain access to sensitive information on an affected system.
This vulnerability is due to the unsafe usage of shared memory by the affected software. An attacker with permissions to view system memory could exploit this vulnerability by running an application on the local system that is designed to read shared memory. A successful exploit could allow the attacker to retrieve sensitive information from the shared memory, including usernames, meeting information, or authentication tokens.
Note: To exploit this vulnerability, an a
Cisco
Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows Shared Memory Information Disclosure Vulnerability
vendor_cisco·CVSS 3.1
CVE-2021-1372 Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows Shared Memory Information Disclosure Vulnerability
CVE-2021-1372: Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows Shared Memory Information Disclosure Vulnerability
A vulnerability in Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows could allow an authenticated, local attacker to gain access to sensitive information on an affected system. This vulnerability is due to the unsafe usage of shared memory by the affected software. An attacker with permissions to view system memory could exploit this vulnerability by running an application on the local system that is designed to read shared memory. A successful exploit could allow the attacker to retrieve sensitive information from the shared memory, including usernames, meeting information, or authentication tokens. Note: To exploit this vulner
GHSA
GHSA-r5cq-f6p7-hpq4: A vulnerability in Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows could allow an authenticated, local attacker to gain acce
ghsa_unreviewed·2022-05-24
CVE-2021-1372 [MEDIUM] CWE-202 GHSA-r5cq-f6p7-hpq4: A vulnerability in Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows could allow an authenticated, local attacker to gain acce
A vulnerability in Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows could allow an authenticated, local attacker to gain access to sensitive information on an affected system. This vulnerability is due to the unsafe usage of shared memory by the affected software. An attacker with permissions to view system memory could exploit this vulnerability by running an application on the local system that is designed to read shared memory. A successful exploit could allow the attacker to retrieve sensitive information from the shared memory, including usernames, meeting information, or authentication tokens. Note: To exploit this vulnerability, an attacker must have valid credentials on a Microsoft Windows end-user system and must log in after another user has already authe
No detection rules found.
No public exploits indexed.
Talos
Vulnerability Spotlight: Heap buffer overflow condition in Google Chrome could lead to code execution
blogs_talos·2022-01-11·CVSS 8.8
[HIGH] Vulnerability Spotlight: Heap buffer overflow condition in Google Chrome could lead to code execution
## Vulnerability Spotlight: Heap buffer overflow condition in Google Chrome could lead to code execution
Marcin Towalski of Cisco Talos discovered this vulnerability.
Cisco Talos recently discovered an exploitable heap-based buffer overflow vulnerability in Google Chrome.
Google Chrome is a cross-platform web browser — and Chromium is the open-source version of the browser that other software developers use to build their browsers, as well. This specific vulnerability exists in WebRTC, a technology that enables websites to capture and stream audio or video and other data between browsers.
TALOS-2021-1372 (CVE-2021-37979) is a heap-based buffer overflow vulnerability that triggers if the user opens a specially crafted web page in Chrome. That page could trigger a heap buffer overflow an
Talos
Vulnerability Spotlight: Heap buffer overflow condition in Google Chrome could lead to code execution
blogs_talos·2022-01-11·CVSS 8.8
[HIGH] Vulnerability Spotlight: Heap buffer overflow condition in Google Chrome could lead to code execution
Marcin Towalski of Cisco Talos discovered this vulnerability.
Cisco Talos recently discovered an exploitable heap-based buffer overflow vulnerability in Google Chrome.
Google Chrome is a cross-platform web browser — and Chromium is the open-source version of the browser that other software developers use to build their browsers, as well. This specific vulnerability exists in WebRTC, a technology that enables websites to capture and stream audio or video and other data between browsers.
TALOS-2021-1372 (CVE-2021-37979) is a heap-based buffer overflow vulnerability that triggers if the user opens a specially crafted web page in Chrome. That page could trigger a heap buffer overflow and memory corruption error in the application and buffer overflow, which could lead to code execution.
Cis
2021-02-17
Published