A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS)…

Published 8 y ago 2018-06-07 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.1

v3.0 · NVD

CISA KEV

not known exploited

EPSS

1.7%

percentile 78%

Public exploits

none known

A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software via the HTTP GET and HTTP POST methods. An attacker who can convince a user to follow an attacker-supplied link could execute arbitrary script or HTML code in the user's browser in the context of an affected site. Cisco Bug IDs: CSCvi63757.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 23 mo ago 2024-11-29

Exploit prediction (EPSS)

1.75% probability of exploitation in the next 30 days, higher than 78% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	6.1	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:P/A:N`

Affected products

n/a Cisco WebEx unknown

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20180606-webex-xss · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/104421 · vdb-entry, x_refsource_BID, x_transferred
securitytracker.com /id/1041062 · vdb-entry, x_refsource_SECTRACK, x_transferred

Sources

CVE List: CVE-2018-0356
NVD: CVE-2018-0356

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary