CVE-2017-12363

A vulnerability in Cisco WebEx Meeting Server could allow an unauthenticated, remote attacker to modify the welcome message of a meeting on an affected system. The vulnerability is due to insufficient security settings on meetings. An attacker could exploit this vulnerability by modifying the welcome message to a meeting. A successful exploit could allow the attacker to modify the welcome message of any known meeting. Cisco Bug IDs: CSCvf68695.

CVSS v3 5.3 MEDIUM
CVSS v2.0 5.0 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/102000	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1039921	Third Party Advisory VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-webex3	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:cisco:webex_meetings_server:2.6.0.8:::::::*
	cpe:2.3:a:cisco:webex_meetings_server:2.7:::::::*

History

No history.

Information

Published : 2017-11-30 09:29

Updated : 2023-12-10 12:15

NVD link : CVE-2017-12363

Mitre link : CVE-2017-12363

CVE.ORG link : CVE-2017-12363

JSON object : View

Products Affected

cisco

webex_meetings_server

CWE

CWE-668

Exposure of Resource to Wrong Sphere

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2017-12363", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2017-11-30T09:29:01.417", "references": [{"url": "http://www.securityfocus.com/bid/102000", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "http://www.securitytracker.com/id/1039921", "tags": ["Third Party Advisory", "VDB Entry"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-webex3", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-668"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in Cisco WebEx Meeting Server could allow an unauthenticated, remote attacker to modify the welcome message of a meeting on an affected system. The vulnerability is due to insufficient security settings on meetings. An attacker could exploit this vulnerability by modifying the welcome message to a meeting. A successful exploit could allow the attacker to modify the welcome message of any known meeting. Cisco Bug IDs: CSCvf68695."}, {"lang": "es", "value": "Una vulnerabilidad en Cisco WebEx Meeting Server podr\u00eda permitir que un atacante remoto sin autenticar modifique el mensaje de bienvenida de una reuni\u00f3n en un sistema afectado. Esta vulnerabilidad se debe a la falta de opciones de seguridad en las reuniones. Un atacante podr\u00eda aprovechar esta vulnerabilidad modificando el mensaje de bienvenida en una reuni\u00f3n. Un exploit con \u00e9xito podr\u00eda permitir que el atacante modifique el mensaje de bienvenida de cualquier reuni\u00f3n conocida. Cisco Bug IDs: CSCvf68695."}], "lastModified": "2019-10-09T23:23:01.327", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:webex_meetings_server:2.6.0.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4139ACAA-A316-40DE-9170-2080D892AF19"}, {"criteria": "cpe:2.3:a:cisco:webex_meetings_server:2.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DFAAD0CF-0CAA-4D8B-A12F-9BAF1DC3CD6D"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}