PT-2022-2311 · Cisco · Cisco Webex Meetings

Hatim Chabik · Published 2022-01-19 · Updated 2025-08-07 · CVE-2022-20654

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Webex Meetings (affected versions not specified)

Description The issue exists due to insufficient validation of user-supplied input by the web-based interface of Cisco Webex Meetings. An attacker could exploit this by persuading a user to click a maliciously crafted link, potentially allowing the execution of arbitrary script code in the context of the affected interface or access to sensitive, browser-based information. This could enable the attacker to disclose protected information, modify the appearance of the web page, or conduct phishing and drive-by download attacks.

Recommendations For all affected versions of Cisco Webex Meetings, update to the latest software version released by Cisco, as it addresses this vulnerability. At the moment, there is no information about additional mitigation measures or workarounds that address this vulnerability.

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

BDU:2022-02497

CVE-2022-20654

Affected Products

Cisco Webex Meetings

References · 7

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-FmbPu2pe · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20654 · Security Note
• https://osv.dev/vulnerability/CVE-2022-20654 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-02497 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-xss-FmbPu2pe · Note
• https://t.me/cveNotify/131171 · Telegram Post
• https://twitter.com/CVEnew/status/1857458717089775851 · Twitter Post