CVE-2018-0108
A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to collect customer files via an out-of-band…
Published 8 y ago · modified 4 mo ago · JSON
Summary
A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to collect customer files via an out-of-band XML External Entity (XXE) injection. An attacker could exploit this vulnerability to gain information to conduct additional reconnaissance attacks. The vulnerability is due to the ability of an attacker to perform an out-of-band XXE injection on the system, which could allow an attacker to capture customer files and redirect them to another destination address. An exploit could allow the attacker to discover sensitive customer data. Cisco Bug IDs: CSCvg36996.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 23 mo ago
Exploit prediction (EPSS)
1.83% probability of exploitation in the next 30 days, higher than 79% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- n/a Cisco WebEx Meetings Server
Classification
- Weakness
- CWE-611 Improper Restriction of XML External Entity Reference
References
- securitytracker.com /id/1040238 · vdb-entry, x_refsource_SECTRACK, x_transferred
- securityfocus.com /bid/102720 · vdb-entry, x_refsource_BID, x_transferred
- tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-wms · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2018-0108
- NVD: CVE-2018-0108
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.