CVE-2021-1410
Estado: AnalizadaMedia (4.3)—
A vulnerability in the distribution list feature of Cisco Webex Meetings could allow an authenticated, remote attacker to modify a distribution list that belongs to another user of their organization. The vulnerability is due to insufficient authorization enforcement for requests to update distribution lists. An attacker could exploit this vulnerability by sending a crafted request to the Webex Meetings interface to modify an existing distribution list. A successful exploit could allow the attacker to modify a distribution list that belongs to a user other than themselves.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Puntuación base: 4.3
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.83%
- Percentil entre todas las CVEs puntuadas: 56
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-284
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2021-1410",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2021-1410",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-11-18T15:57:44.137749Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 4.3,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 1.4,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "psirt@cisco.com",
"affectedData": [
{
"vendor": "Cisco",
"product": "Cisco Webex Meetings",
"versions": [
{
"status": "affected",
"version": "39.7.7"
},
{
"status": "affected",
"version": "39.9"
},
{
"status": "affected",
"version": "40.4.10"
},
{
"status": "affected",
"version": "39.6"
},
{
"status": "affected",
"version": "40.6.2"
},
{
"status": "affected",
"version": "39.8.2"
},
{
"status": "affected",
"version": "39.8.4"
},
{
"status": "affected",
"version": "40.1"
},
{
"status": "affected",
"version": "39.11"
},
{
"status": "affected",
"version": "39.7.4"
},
{
"status": "affected",
"version": "39.9.1"
},
{
"status": "affected",
"version": "40.4"
},
{
"status": "affected",
"version": "40.6"
},
{
"status": "affected",
"version": "39.7"
},
{
"status": "affected",
"version": "39.8"
},
{
"status": "affected",
"version": "39.8.3"
},
{
"status": "affected",
"version": "40.2"
},
{
"status": "affected",
"version": "39.10"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2024-11-18T16:15:09.553",
"references": [
{
"url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-distupd-N87eB6Z3",
"tags": [
"Vendor Advisory"
],
"source": "psirt@cisco.com"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Secondary",
"source": "psirt@cisco.com",
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the distribution list feature of Cisco Webex Meetings could allow an authenticated, remote attacker to modify a distribution list that belongs to another user of their organization.\r\nThe vulnerability is due to insufficient authorization enforcement for requests to update distribution lists. An attacker could exploit this vulnerability by sending a crafted request to the Webex Meetings interface to modify an existing distribution list. A successful exploit could allow the attacker to modify a distribution list that belongs to a user other than themselves.Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability."
},
{
"lang": "es",
"value": "Una vulnerabilidad en la función de lista de distribución de Cisco Webex Meetings podría permitir que un atacante remoto autenticado modifique una lista de distribución que pertenece a otro usuario de su organización. La vulnerabilidad se debe a una aplicación insuficiente de la autorización para las solicitudes de actualización de listas de distribución. Un atacante podría aprovechar esta vulnerabilidad enviando una solicitud manipulada a la interfaz de Webex Meetings para modificar una lista de distribución existente. Una explotación exitosa podría permitir al atacante modificar una lista de distribución que pertenece a un usuario que no sea él mismo. Cisco ha publicado actualizaciones de software que solucionan esta vulnerabilidad. No existen workarounds que solucionen esta vulnerabilidad."
}
],
"lastModified": "2026-06-17T03:31:42.703",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:cisco:webex_meetings:39.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4F3FA883-F14A-424A-8CEA-E7B140311B88"
},
{
"criteria": "cpe:2.3:a:cisco:webex_meetings:39.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D1A28A13-3554-4951-9BC6-D57E68672648"
},
{
"criteria": "cpe:2.3:a:cisco:webex_meetings:39.7.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8A9F521F-5D30-4DE7-A308-D1EC7F17C5FB"
},
{
"criteria": "cpe:2.3:a:cisco:webex_meetings:39.7.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DA6A48E8-0B18-49F7-9869-A493F356778E"
},
{
"criteria": "cpe:2.3:a:cisco:webex_meetings:39.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "25230DAE-8870-4D37-A61A-E352C1B3D745"
},
{
"criteria": "cpe:2.3:a:cisco:webex_meetings:39.8.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3875C388-7B83-451C-8F37-609A414B847E"
},
{
"criteria": "cpe:2.3:a:cisco:webex_meetings:39.8.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "17D2A6BB-43D5-4907-BA8E-0EFC5C45A8E4"
},
{
"criteria": "cpe:2.3:a:cisco:webex_meetings:39.8.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "43E36526-AD0B-4020-86B5-0681D6D4A845"
},
{
"criteria": "cpe:2.3:a:cisco:webex_meetings:39.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "787AA492-5044-4A98-BA14-DE1D2DB09435"
},
{
"criteria": "cpe:2.3:a:cisco:webex_meetings:39.9.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D1752401-15DE-42A1-B7A1-F6C82DAEE1A4"
},
{
"criteria": "cpe:2.3:a:cisco:webex_meetings:39.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A89D03AD-C0CB-48B9-9B17-C4397F7BCC6E"
},
{
"criteria": "cpe:2.3:a:cisco:webex_meetings:39.11:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2DD47BA5-5DA9-4C0E-BE96-F1E94E444DE4"
},
{
"criteria": "cpe:2.3:a:cisco:webex_meetings:40.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "69A90D5E-EA48-4738-BE1B-78FBDAD33017"
},
{
"criteria": "cpe:2.3:a:cisco:webex_meetings:40.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "94E66A90-D684-4185-8C28-727B62AFB39D"
},
{
"criteria": "cpe:2.3:a:cisco:webex_meetings:40.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0082B39D-BC0E-4716-8332-A04EA6BBBDD8"
},
{
"criteria": "cpe:2.3:a:cisco:webex_meetings:40.4.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F82C6242-BCD3-43C1-8B1D-4044C4263050"
},
{
"criteria": "cpe:2.3:a:cisco:webex_meetings:40.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "982C57A9-231E-4CB2-80A8-19A2DF951615"
},
{
"criteria": "cpe:2.3:a:cisco:webex_meetings:40.6.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "11176259-0359-416D-A22D-DEBEBE755FE9"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "psirt@cisco.com"
}