Cisco Webex Meetings Vulnerability: Modification of Distribution Lists by Unauthorized Users

CVE-2021-1410

Summary

A vulnerability exists in the distribution list feature of Cisco Webex Meetings, enabling an authenticated remote attacker to alter distribution lists belonging to other users within the same organization. This flaw arises from inadequate enforcement of authorization checks when processing update requests for distribution lists. An attacker capable of exploiting this vulnerability can send a specially crafted request to the Webex Meetings interface, thereby gaining the ability to modify distribution lists they are not entitled to access. Cisco has released updates aimed at addressing this issue, with no workarounds available to mitigate the risk.

References