CVE-2018-0387
A vulnerability in Cisco Webex Teams (for Windows and macOS) could allow an unauthenticated, remote attacker to execute arbitrary code on t…
Published 8 y ago · modified 4 mo ago · JSON
Summary
A vulnerability in Cisco Webex Teams (for Windows and macOS) could allow an unauthenticated, remote attacker to execute arbitrary code on the user's device, possibly with elevated privileges. The vulnerability occurs because Cisco Webex Teams does not properly sanitize input. An attacker could exploit the vulnerability by sending a user a malicious link and persuading the user to follow the link. A successful exploit could allow the attacker to execute arbitrary code on the user's system. Cisco Bug IDs: CSCvh66250.
CISA SSVC assessment
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 23 mo ago
Exploit prediction (EPSS)
3.11% probability of exploitation in the next 30 days, higher than 88% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Affected products
- n/a Cisco Webex Teams unknown
Classification
- Weakness
- CWE-20 Improper Input Validation
References
- tools.cisco.com /security/center/content/CiscoSecurityAdvisory/cisco-sa-20180718-webex-teams-rce · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/104873 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2018-0387
- NVD: CVE-2018-0387
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.