CVE-2021-1410: 
Cisco Webex Meetings vulnerability analysis and mitigation

A vulnerability (CVE-2021-1410) was discovered in the distribution list feature of Cisco Webex Meetings that could allow an authenticated, remote attacker to modify a distribution list belonging to another user within their organization. The vulnerability was disclosed on March 3, 2021, affecting Cisco Webex Meetings releases earlier than 41.2.0 (Cisco Advisory).

The vulnerability stems from insufficient authorization enforcement for requests to update distribution lists in Cisco Webex Meetings. It has been assigned a CVSS base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The vulnerability is classified as CWE-284 (Improper Access Control) (Cisco Advisory).

A successful exploitation of this vulnerability would allow an attacker to modify distribution lists belonging to other users within their organization, potentially leading to unauthorized changes in communication groups (Cisco Advisory).

The vulnerability can be exploited by sending a crafted request to the Webex Meetings interface to modify an existing distribution list. At the time of disclosure, Cisco PSIRT was not aware of any public announcements or malicious exploitation of this vulnerability (Cisco Advisory).

Cisco has released software updates that address this vulnerability in Webex Meetings Release 41.2.0 and later. No user action is required as the service is cloud-based. There are no workarounds available for this vulnerability. Customers can verify their current remediation status or software version through the Help function in the service GUI (Cisco Advisory).