CVE-2021-40115— Cisco Webex Video Mesh Cross-Site Scripting Vulnerability
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-40115
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cisco Webex Video Mesh Cross-Site Scripting Vulnerability
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability in Cisco Webex Video Mesh could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Cisco Webex Video Mesh 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco Webex Video Mesh是美国思科（Cisco）公司的一款软件。Cisco Webex Video Mesh可动态找到本地和云会议资源的最佳组合。当本地资源充足时，本地会议将停留在本地。当本地资源耗尽时，会议再扩展到云中。 Cisco Webex Video Mesh 存在跨站脚本漏洞，该漏洞源于web管理界面对用户提供的输入验证不足造成的。攻击者可利用该漏洞在界面上下文中执行任意脚本代码，或者访问敏感的、基于浏览器的信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Cisco | Cisco Webex Video Mesh | n/a | - |
II. Public POCs for CVE-2021-40115
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-40115
请登录查看更多情报信息。
- https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-videomesh-xss-qjm2BDQfvendor-advisoryx_refsource_CISCO
- https://nvd.nist.gov/vuln/detail/CVE-2021-40115
Same Patch Batch · Cisco · 2021-11-04 · 18 CVEs total
| CVE-2021-34795 | 10.0 CRITICAL | Cisco Catalyst PON Series Switches Optical Network Terminal Vulnerabilities |
| CVE-2021-40112 | 10.0 CRITICAL | Cisco Catalyst PON Series Switches Optical Network Terminal Vulnerabilities |
| CVE-2021-40113 | 10.0 CRITICAL | Cisco Catalyst PON Series Switches Optical Network Terminal Vulnerabilities |
| CVE-2021-40119 | 9.8 CRITICAL | Cisco Policy Suite Static SSH Keys Vulnerability |
| CVE-2021-34739 | 8.1 HIGH | Cisco Small Business Series Switches Session Credentials Replay Vulnerability |
| CVE-2021-34741 | 7.5 HIGH | Cisco Email Security Appliance Denial of Service Vulnerability |
| CVE-2021-40124 | 6.7 MEDIUM | Cisco AnyConnect Secure Mobility Client for Windows with Network Access Manager Module Pri |
| CVE-2021-34773 | 6.5 MEDIUM | Cisco Unified Communications Products Cross-Site Request Forgery Vulnerability |
| CVE-2021-40120 | 6.5 MEDIUM | Cisco Small Business RV Series Routers Command Injection Vulnerability |
| CVE-2021-1500 | 5.4 MEDIUM | Cisco Webex Video Mesh Arbitrary Site Redirection Vulnerability |
| CVE-2021-34784 | 5.4 MEDIUM | Cisco Prime Infrastructure and Evolved Programmable Network Manager Stored Cross-Site Scri |
| CVE-2021-40128 | 5.3 MEDIUM | Cisco Webex Meetings Email Content Injection Vulnerability |
| CVE-2021-40127 | 5.3 MEDIUM | Cisco Small Business 200, 300, and 500 Series Switches Web-Based Management Interface Deni |
| CVE-2021-34774 | 4.9 MEDIUM | Cisco Common Services Platform Collector Information Disclosure Vulnerability |
| CVE-2021-34731 | 4.8 MEDIUM | Cisco Prime Access Registrar Stored Cross-Site Scripting Vulnerability |
| CVE-2021-40126 | 4.3 MEDIUM | Cisco Umbrella Email Enumeration Vulnerability |
| CVE-2021-34701 | 4.3 MEDIUM | Cisco Unified Communications Products Path Traversal Vulnerability |
IV. Related Vulnerabilities
Same vendor: Cisco
- CVE-2026-20199
Cisco ThousandEyes Virtual Appliance 证书验证漏洞致远程代码执行 - CVE-2026-20171
Cisco Nexus 3000 and 9000 Series Border Gateway Protocol Den - CVE-2026-20206
Cisco ThousandEyes BrowserBot Command Injection Vulnerabilit - CVE-2026-20223
Cisco Secure Workload Unauthorized API Access Vulnerability - CVE-2026-20224
Cisco Catalyst SD-WAN Manager XML External Entity Injection
Same weakness: CWE-79
- CVE-2026-1543
Avada (Fusion) Builder <= 3.15.2 - Authenticated (Subscriber - CVE-2026-4811
WPB Floating Menu or Categories – Sticky Floating Side Menu - CVE-2026-39960
MantisBT is Vulnerable to Stored XSS through Custom Field Te - CVE-2026-9144
Taiko AG1000-01A Rev 7.3/8 Stored XSS via Web Configuration - CVE-2026-35016
Open ISES Tickets < 3.44.2 Reflected XSS via search.php frm_
V. Comments for CVE-2021-40115
No comments yet