// For flags

CVE-2021-40128

Cisco Webex Meetings Email Content Injection Vulnerability

Severity Score

5.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Attend
*SSVC
Descriptions

A vulnerability in the account activation feature of Cisco Webex Meetings could allow an unauthenticated, remote attacker to send an account activation email with an activation link that points to an arbitrary domain. This vulnerability is due to insufficient validation of user-supplied parameters. An attacker could exploit this vulnerability by sending a crafted HTTP request to the account activation page of Cisco Webex Meetings. A successful exploit could allow the attacker to send to any recipient an account activation email that contains a tampered activation link, which could direct the user to an attacker-controlled website.

Una vulnerabilidad en la funcionalidad account activation de Cisco Webex Meetings podría permitir a un atacante remoto no autenticado enviar un correo electrónico de activación de cuentas con un enlace de activación que apunte a un dominio arbitrario. Esta vulnerabilidad es debido a que no son comprobados suficientemente los parámetros proporcionados por el usuario. Un atacante podría explotar esta vulnerabilidad mediante el envío de una petición HTTP diseñada a la página de activación de cuentas de Cisco Webex Meetings. Un ataque exitoso podría permitir al atacante enviar a cualquier destinatario un correo electrónico de activación de cuenta que contenga un enlace de activación manipulado, que podría dirigir al usuario a un sitio web controlado por el atacante

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Attend
Exploitation
None
Automatable
Yes
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2021-08-25 CVE Reserved
  • 2021-11-04 CVE Published
  • 2024-11-07 CVE Updated
  • 2024-11-21 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-183: Permissive List of Allowed Inputs
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Webex Meetings
Search vendor "Cisco" for product "Webex Meetings"
--
Affected