This vulnerability in Cisco Slido's REST API was caused by an insecure direct object reference, enabling an authenticated attacker to bypass authorization controls via user-controlled keys. Exploitation involved sending crafted requests to the vulnerable API endpoint, potentially exposing social profile data of other users and allowing manipulation of quiz and poll results. Cisco has fixed the issue in Cisco Slido, and no further customer action is required. The vulnerability affects numerous versions of Cisco Webex Meetings, but the vendor advisory confirms remediation has been applied.

An attacker with valid authentication could have accessed other users' social profile data and altered quiz and poll results within Cisco Slido. This impacts confidentiality and integrity but does not affect availability. There are no known exploits in the wild. The vulnerability is rated medium severity with a CVSS 3.1 base score of 5.4.

Cisco has addressed this vulnerability in Cisco Slido, and no customer action is needed. Users should ensure they are running a fixed version of Cisco Webex Meetings or Cisco Slido as per Cisco's advisory. Since this is not a cloud service, customers should apply updates when available. Patch status is not explicitly stated but the vendor confirms the issue is resolved.