Executive Summary

Summary
Title +++++ Cisco WebEx Meetings Server Command Injection Vulnerability
Informations
Name cisco-sa-20150204-wbx First vendor Publication 2015-02-04
Vendor Cisco Last vendor Modification 2015-02-04
Severity (Vendor) N/A Revision 1.0

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:C/I:C/A:C)
Cvss Base Score 9 Attack Range Network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 8 Authentication Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

A vulnerability in the administrative web interface of Cisco WebEx Meetings Server could allow an authenticated, remote attacker to execute arbitrary commands on the affected system and on the devices managed by the affected system.

The vulnerability is due to improper user input validation. An attacker could exploit this vulnerability by crafting input into the affected fields of the web interface.

Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available. This advisory is available at the following link: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20150204-wbx BEGIN PGP SIGNATURE Version: GnuPG v1.4.5 (SunOS)

iQIVAwUBVNIdpopI1I6i1Mx3AQK3jg//VoUsfkTzWyRDXjeEMWLJczcH/GCN+c7c C4yqhNM0qZfe9klBfpaTBgXUQ1m4zgEtqnJrceESCIiLkNj5G3u6DKq0gwlXpc+t 59qV6D+kCxyS8gGv9sdjDrZmk7ZzlKxpPoVeSgw7qFqPg95YnoQsGv06s5ddJy5b fAqqGrnnkEZA6feFmg/bC79qKpE3vPck8vB+Zkgcr5VkhnwhWBwBFGj6TQzvs5ao GQkh4aGZYwA1y1Ub9ZCiPULhiJqAs/3/+JoEzuJ+Vap4D7jRGqQXIcO1dxwiWMp8 IaLThYMERWkIUHB9EEijkuERsPEL2VNRlVlqorRpWOAqIDmR9xVjRWaUzxxLMN0K Aqe966KM9cjEL1l+XOCbxSxVGuduAOXqrU6izrjHfCO2mk3i3wopg4F0ubBndl2x ljZ/wgfQsBD6Ec4HE9LSpZUZRI7W5jghbiI2xkc8/yW2RfKQMvRuGpLZhDq1kU4X hKMzNz2jS7kzC+u1VZQQiSPJH+15iRuCmoAlFQl4+gc2o0dGRq02AFI2ifSAjVvn UlbO42dkcN1MIHpCnb3l/CLQz54rTCvbwizgEbgX0+adyZekdhKepn4yLwgGOiJC hC5cvxruTphTfmdA1DYBWGAQOkc5U5LQ389T1imSEoI5Wbj+cO1O5Nc5fluY3Wj0 hSX1YVQ1B4Q= =+3An END PGP SIGNATURE _______________________________________________ cust-security-announce mailing list cust-security-announce@cisco.com To unsubscribe, send the command "unsubscribe" in the subject of your message to cust-security-announce-leave@cisco.com

Original Source

Url : http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco (...)

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-20 Improper Input Validation

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 3

Snort® IPS/IDS

Date Description
2016-03-14 Cisco WebEx Meetings Server command injection attempt
RuleID : 36913 - Revision : 2 - Type : SERVER-WEBAPP

Alert History

If you want to see full details history, please login or register.
0
1
Date Informations
2015-02-10 00:25:32
  • Multiple Updates
2015-02-06 05:22:32
  • First insertion