CVE-2021-40115

Medium

Description

A vulnerability in Cisco Webex Video Mesh could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface. An attacker could exploit this vulnerability by persuading a user to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive, browser-based information.

SeverityMedium

CVSS6.1

Exploit probability—

Product

Cisco Webex Video Mesh

PublishedNov 4, 2021

First seenNov 4, 2021

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

cisco webex_video_mesh2021.10.18.2439m or later

Vendor advisories

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-videomesh-xss-qjm2BDQf

Affected products

Product	Affected versions	Fixed in
cisco webex_video_mesh	v < 2021.10.18.2439m	2021.10.18.2439m
cisco collaboration_meeting_rooms	2.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.