CVE-2021-1525— Cisco Webex Meetings and Webex Meetings Server File Redirect Vulnerability
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-1525
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco Webex Meetings and Webex Meetings Server File Redirect Vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to redirect users to a malicious file. This vulnerability is due to improper validation of URL paths in the application interface. An attacker could exploit this vulnerability by persuading a user to follow a specially crafted URL that is designed to cause Cisco Webex Meetings to include a remote file in the web UI. A successful exploit could allow the attacker to cause the application to offer a remote file to a user, which could allow the attacker to conduct further phishing or spoofing attacks.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
指向未可信站点的URL重定向(开放重定向)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Cisco Webex Meetings 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Webex Meetings是美国思科（Cisco）公司的一个视频会议和在线会议软件。提供带有共享、聊天等功能的视频和音频会议。 Cisco Webex Meetings和Cisco Webex meeting Server存在输入验证错误漏洞，该漏洞允许未经验证的远程攻击者可利用该漏洞将用户重定向到一个恶意文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco WebEx Meetings Server | n/a | - |
II. Public POCs for CVE-2021-1525
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-1525
请登录查看更多情报信息。
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-redirect-XuZFU3PHvendor-advisoryx_refsource_CISCO
- https://nvd.nist.gov/vuln/detail/CVE-2021-1525
Same Patch Batch · Cisco · 2021-06-04 · 15 CVEs total
| CVE-2021-1540 | 8.1 HIGH | Cisco ASR 5000 Series Software Authorization Bypass Vulnerabilities |
| CVE-2021-1539 | 8.1 HIGH | Cisco ASR 5000 Series Software Authorization Bypass Vulnerabilities |
| CVE-2021-1528 | 7.8 HIGH | Cisco SD-WAN Software Privilege Escalation Vulnerability |
| CVE-2021-1526 | 7.8 HIGH | Cisco Webex Player Memory Corruption Vulnerability |
| CVE-2021-1503 | 7.8 HIGH | Cisco Webex Network Recording Player and Webex Player Memory Corruption Vulnerability |
| CVE-2021-1502 | 7.8 HIGH | Cisco Webex Network Recording Player and Webex Player Memory Corruption Vulnerability |
| CVE-2021-1564 | 6.5 MEDIUM | Cisco Video Surveillance 7000 Series IP Cameras Cisco Discovery and Link Layer Discovery P |
| CVE-2021-1563 | 6.5 MEDIUM | Cisco Video Surveillance 7000 Series IP Cameras Cisco Discovery and Link Layer Discovery P |
| CVE-2021-1537 | 6.2 MEDIUM | Cisco ThousandEyes Recorder Information Disclosure Vulnerability |
| CVE-2021-1544 | 5.5 MEDIUM | Cisco Webex Meetings Client Software Logging Information Disclosure Vulnerability |
| CVE-2021-1527 | 5.3 MEDIUM | Cisco Webex Player Memory Corruption Vulnerability |
| CVE-2021-1517 | 5.0 MEDIUM | Cisco Webex Meetings and Webex Meetings Server Multimedia Sharing Security Bypass Vulnerab |
| CVE-2021-1536 | 4.8 MEDIUM | Cisco Webex Meetings, Webex Network Recording Player, and Webex Teams DLL Injection Vulner |
| CVE-2021-1538 | 4.7 MEDIUM | Cisco Common Services Platform Collector Command Injection Vulnerability |
IV. Related Vulnerabilities
Same product: Cisco WebEx Meetings Server
- CVE-2021-1517
Cisco Webex Meetings and Webex Meetings Server Multimedia Sh - CVE-2021-1221
Cisco Webex Meetings and Cisco Webex Meetings Server Softwar - CVE-2021-1311
Cisco Webex Meetings and Cisco Webex Meetings Server Host K - CVE-2020-3471
Cisco Webex Meetings and Cisco Webex Meetings Server Unautho - CVE-2020-3441
Cisco Webex Meetings and Cisco Webex Meetings Server Informa
Same vendor: Cisco
- CVE-2026-20219
Cisco Slido 安全漏洞 - CVE-2026-20034
Cisco Unity Connection Remote Code Execution Vulnerability - CVE-2026-20035
Cisco Unity Connection Server-Side Request Forgery Vulnerabi - CVE-2026-20167
Cisco IoT Field Network Director Remote Device Denial of Ser - CVE-2026-20169
Cisco IoT Field Network Director Command Injection Vulnerabi
Same weakness: CWE-601
- CVE-2026-42350
Kargo: Open Redirect in UI OIDC Login Flow via redirectTo Qu - CVE-2026-42195
Unvalidated gitlab URL parameter redirects OAuth authorize s - CVE-2026-3318
Multiple vulnerabilities in Cradle e-commerce - CVE-2026-42259
Saltcorn: Open Redirect in `POST /auth/login` due to incompl - CVE-2026-6795
Open Redirect in DivvyDrive Information Technologies' DivvyD
V. Comments for CVE-2021-1525
No comments yet