CVE-2019-1680 Cisco Webex Business Suite Content Injection Vulnerability
An unauthenticated remote attacker can inject arbitrary text into a user's browser via a malicious URL, enabling spoofing attacks in Cisco Webex Business Suite.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-1680?
CVE-2019-1680 is a medium-severity cross-site scripting vulnerability in Cisco Webex Meetings Online, published on 7 Feb 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in Cisco Webex Business Suite could allow an unauthenticated, remote attacker to inject arbitrary text into a user's browser. The vulnerability is due to improper validation of input. An attacker could exploit this vulnerability by convincing a targeted user to view a malicious URL. A successful exploit could allow the attacker to inject arbitrary text into the user's browser. The attacker could use the content injection to conduct spoofing attacks. Versions prior than 3.0.9 are affected.
Which versions are affected by CVE-2019-1680?
It affects 2 products.
Products include Cisco Webex Business Suite, Cisco Webex Meetings Online.
How do I fix CVE-2019-1680?
No fix has been published for CVE-2019-1680 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2019-1680 being exploited?
There is no known exploitation of CVE-2019-1680 in the wild and no public exploit code.
Other vulnerabilities in Cisco Webex Meetings Online
- CVE-2018-0104 Code injection in Cisco WebEx Advanced Recording Format Player
- CVE-2019-15284 Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities
- CVE-2019-15286 Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities
- CVE-2019-1924 Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities
- CVE-2019-1925 Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities
Sources
Also known as GHSA-5679-xjjc-jqgx.