CVE-2021-1310: cisco cisco webex meetings Open Redirect

Vulnerability summary

CVE-2021-1310 is a medium (CVSS 4.7) Open Redirect vulnerability in cisco cisco webex meetings. EPSS estimates a 1.60% chance of exploitation in the next 30 days, higher than 75.4% of scored vulnerabilities.

Timeline

1. 13-01-2021
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the web-based management interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to redirect a user to an untrusted web page, bypassing the warning mechanism that should prompt the user before the redirection. This vulnerability is due to improper input validation of the URL parameters in an HTTP request. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to redirect a user to a malicious website, bypassing the Webex URL check that should result in a warning before the redirection to the web page. Attackers may use this type of vulnerability, known as an open redirect attack, as part of a phishing attack to convince users to unknowingly visit malicious sites.

• CWE-601URL Redirection to Untrusted Site ('Open Redirect')The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.