vulnwire
9.6crit

CVE-2017-12367

A "Cisco WebEx Network Recording Player Denial of Service Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced Record…

Published 8 y ago · modified 4 mo ago · JSON

CVSS
9.6
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.8%
percentile 87%
Public exploits
0
none known

A "Cisco WebEx Network Recording Player Denial of Service Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) and WebEx Recording Format (WRF) files. A remote attacker could exploit this by providing a user with a malicious ARF or WRF file via email or URL and convincing the user to launch the file. Exploitation of this could cause an affected player to crash and, in some cases, could allow arbitrary code execution on the system of a targeted user. Cisco Bug IDs: CSCve11545, CSCve02843, CSCve11548.

Exploit prediction (EPSS)

2.83% probability of exploitation in the next 30 days, higher than 87% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.09.6CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD2.06.8AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

  • n/a Cisco WebEx Recording Format and Advanced Recording Format Players

Classification

Weakness
  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
  • CWE-20 Improper Input Validation

References

  • securityfocus.com /bid/102017 · vdb-entry, x_refsource_BID, x_transferred
  • securitytracker.com /id/1039895 · vdb-entry, x_refsource_SECTRACK, x_transferred
  • tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-webex-players · x_refsource_CONFIRM, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.