PT-2019-4325 · Cisco · Cisco Webex Meetings

Published 2019-11-20 · Updated 2021-11-02 · CVE-2019-15960

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Webex Meetings (affected versions not specified)

Description The issue is related to insufficient access control validation, allowing an authenticated, remote attacker to elevate privileges in the context of the affected Webex Network Recording Admin page. To exploit this, the attacker must be logged in as a low-level administrator and submit a crafted URL request to gain privileged access. A successful exploit could allow the attacker to view or delete recordings they would not normally be able to access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2020-00040

CVE-2019-15960

Affected Products

Cisco Webex Meetings

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191106-wbs-privilege · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-15960 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-15960 · Security Note
• https://bdu.fstec.ru/vul/2020-00040 · Security Note