CVE-2021-1420 Cisco Webex Meetings HTML Injection Vulnerability
An attacker can inject HTML into Webex Meetings pages via crafted links, enabling redirects or client-side attacks against users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-1420?
CVE-2021-1420 is a medium-severity cross-site scripting vulnerability in Cisco Webex Meetings, published on 8 Apr 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in certain web pages of Cisco Webex Meetings could allow an unauthenticated, remote attacker to modify a web page in the context of a user's browser. The vulnerability is due to improper checks on parameter values in affected pages. An attacker could exploit this vulnerability by persuading a user to follow a crafted link that is designed to pass HTML code into an affected parameter. A successful exploit could allow the attacker to alter the contents of a web page to redirect the user to potentially malicious websites, or the attacker could use this vulnerability to conduct further client-side attacks.
Weakness: CWE-80
Which versions are affected by CVE-2021-1420?
It affects 1 product.
Products include Cisco Webex Meetings.
How do I fix CVE-2021-1420?
No fix has been published for CVE-2021-1420 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-1420 being exploited?
There is no known exploitation of CVE-2021-1420 in the wild and no public exploit code.
Other vulnerabilities in Cisco Webex Meetings
- CVE-2017-12368 Memory corruption in Cisco WebEx Recording Format and Advanced Recording Format Players
- CVE-2017-12369 Memory corruption in Cisco WebEx Recording Format and Advanced Recording Format Players
- CVE-2017-12370 Memory corruption in Cisco WebEx Recording Format and Advanced Recording Format Players
- CVE-2017-12371 Memory corruption in Cisco WebEx Recording Format and Advanced Recording Format Players
- CVE-2017-12372 Memory corruption in Cisco WebEx Recording Format and Advanced Recording Format Players
Sources
Also known as GHSA-328f-3qhj-7364.