CVE-2018-0387 Code injection in Cisco Webex Teams unknown

What is CVE-2018-0387?

CVE-2018-0387 is a high-severity code injection vulnerability in Cisco Webex Teams unknown, published on 18 Jul 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A vulnerability in Cisco Webex Teams (for Windows and macOS) could allow an unauthenticated, remote attacker to execute arbitrary code on the user's device, possibly with elevated privileges. The vulnerability occurs because Cisco Webex Teams does not properly sanitize input. An attacker could exploit the vulnerability by sending a user a malicious link and persuading the user to follow the link. A successful exploit could allow the attacker to execute arbitrary code on the user's system. Cisco Bug IDs: CSCvh66250.

Weakness: CWE-20

Which versions are affected by CVE-2018-0387?

It affects 1 product.

Products include Cisco Webex Teams.

How do I fix CVE-2018-0387?

No fix has been published for CVE-2018-0387 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2018-0387 being exploited?

There is no known exploitation of CVE-2018-0387 in the wild and no public exploit code.

Other vulnerabilities in Cisco Webex Teams unknown

• CVE-2025-20236 Cisco Webex App Client-Side Remote Code Execution Vulnerability High 8.8
• CVE-2018-0436 Cisco Webex Teams Information Disclosure and Modification Vulnerability High 8.7
• CVE-2020-3535 Cisco Webex Teams Client for Windows DLL Hijacking Vulnerability High 7.8
• CVE-2019-1636 Cisco Webex Teams URI Handler Insecure Library Loading Vulnerability High 7.8
• CVE-2019-1939 Cisco Webex Teams Logging Feature Command Execution Vulnerability High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6pf4-4j7w-2w8f.