CVE-2013-1205 Missing authorization in n/a
Remote attackers can access host keys and event passwords in Cisco WebEx Meetings Server due to missing request authentication in the Event Center module.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2013-1205?
CVE-2013-1205 is a medium-severity missing authorization vulnerability in Cisco Webex Meetings Server, published on 6 Jun 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Event Center module in Cisco WebEx Meetings Server does not perform request authentication in all intended circumstances, which allows remote attackers to discover host keys and event passwords via crafted URLs, aka Bug ID CSCue62485.
Weakness: CWE-287
Which versions are affected by CVE-2013-1205?
It affects 1 product.
Products include Cisco Webex Meetings Server.
How do I fix CVE-2013-1205?
No fix has been published for CVE-2013-1205 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2013-1205 being exploited?
There is no known exploitation of CVE-2013-1205 in the wild and no public exploit code.
Other vulnerabilities in Cisco Webex Meetings Server
- CVE-2017-12367 Memory corruption in Cisco WebEx Recording Format and Advanced Recording Format Players
- CVE-2015-0589 Command injection in n/a
- CVE-2017-3794 Cross-site request forgery in Cisco WebEx Meetings Server 2.6
- CVE-2016-1448 Cross-site request forgery in n/a
- CVE-2016-1446 SQL injection in n/a
Sources
Also known as GHSA-m95r-m8c3-jhg5.