PT-2019-1383 · Cisco · Webex Meetings

Yogesh Tantak · Publicado 2019-02-06 · Atualizado 2023-03-23 · CVE-2019-1677

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cisco Webex Meetings versions prior to 11.7.0.236

Description The issue is due to insufficient validation of application input parameters, allowing an unauthenticated, local attacker to perform a cross-site scripting attack against the application. An attacker could exploit this by sending a malicious request to the Webex Meetings application, potentially executing script code in the context of the Webex Meetings application. This could allow the attacker to execute arbitrary JavaScript code.

Recommendations For versions prior to 11.7.0.236, update to version 11.7.0.236 or later to resolve the issue. As a temporary workaround, consider restricting the use of intent-based requests to the Webex Meetings application until a patch is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2019-00745

CVE-2019-1677

Produtos afetados

Webex Meetings

Referências · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190206-webex-andro-xss · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-1677 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-1677 · Nota de Segurança
• http://securityfocus.com/bid/106933 · Nota
• https://bdu.fstec.ru/vul/2019-00745 · Nota de Segurança