nvd-json-data-feeds/CVE-2021/CVE-2021-15xx/CVE-2021-1527.json

{
  "id": "CVE-2021-1527",
  "sourceIdentifier": "ykramarz@cisco.com",
  "published": "2021-06-04T17:15:08.903",
  "lastModified": "2021-06-14T18:50:42.430",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in Cisco Webex Player for Windows and MacOS could allow an attacker to cause the affected software to terminate or to gain access to memory state information that is related to the vulnerable application. The vulnerability is due to insufficient validation of values in Webex recording files that are stored in Webex Recording Format (WRF). An attacker could exploit this vulnerability by sending a malicious WRF file to a user as a link or email attachment and then persuading the user to open the file with the affected software on the local system. A successful exploit could allow the attacker to crash the affected software and view memory state information."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad en Cisco Webex Player para Windows y MacOS, podr\u00eda permitir a un atacante causar la finalizaci\u00f3n del software afectado o conseguir acceso a la informaci\u00f3n de estado de la memoria relacionada con la aplicaci\u00f3n vulnerable. La vulnerabilidad es debido a una comprobaci\u00f3n insuficiente de los valores en los archivos de grabaci\u00f3n de Webex que son almacenados en Webex Recording Format (WRF). Un atacante podr\u00eda explotar esta vulnerabilidad mediante el env\u00edo de un archivo WRF malicioso a un usuario como un enlace o un adjunto de correo electr\u00f3nico y luego persuadir al usuario para que abra el archivo con el software afectado en el sistema local. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante bloquear el software afectado y visualizar la informaci\u00f3n del estado de la memoria"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 4.2
      }
    ],
    "cvssMetricV30": [
      {
        "source": "ykramarz@cisco.com",
        "type": "Secondary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 3.4
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:P",
          "accessVector": "NETWORK",
          "accessComplexity": "MEDIUM",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 5.8
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 8.6,
        "impactScore": 4.9,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    },
    {
      "source": "ykramarz@cisco.com",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:cisco:webex_player:*:*:*:*:*:macos:*:*",
              "versionEndExcluding": "41.5",
              "matchCriteriaId": "C52850E9-6516-49C8-8BF3-C68A276230DC"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:cisco:webex_player:*:*:*:*:*:windows:*:*",
              "versionEndExcluding": "41.5",
              "matchCriteriaId": "0E25CC24-78DA-4FA0-8BDB-43CB54FED14A"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-player-kxtkFbnR",
      "source": "ykramarz@cisco.com",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}