CVE-2018-15461 Cisco Webex Business Suite Cross-Site Scripting Vulnerability
An unauthenticated remote attacker can execute arbitrary scripts in a victim's browser via a crafted URL in Cisco Webex Business Suite.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-15461?
CVE-2018-15461 is a medium-severity cross-site scripting vulnerability in Cisco WebEx Meeting Center, published on 10 Jan 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in the MyWebex component of Cisco Webex Business Suite could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack. The vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by convincing a user to click a crafted URL. To exploit this vulnerability, the attacker may provide a link that directs a user to a malicious site and use misleading language or instructions to persuade the user to follow the provided link.
Weakness: CWE-79
Which versions are affected by CVE-2018-15461?
It affects 1 product.
Products include Cisco Webex Business Suite.
How do I fix CVE-2018-15461?
No fix has been published for CVE-2018-15461 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2018-15461 being exploited?
There is no known exploitation of CVE-2018-15461 in the wild and no public exploit code.
Other vulnerabilities in Cisco WebEx Meeting Center
- CVE-2018-0104 Code injection in Cisco WebEx Advanced Recording Format Player
- CVE-2019-15284 Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities
- CVE-2019-15286 Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities
- CVE-2019-1924 Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities
- CVE-2019-1925 Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities
Sources
Also known as GHSA-jrf2-44jj-32mp.