Vulnerability Name: | CVE-2018-0108 (CCN-137712) | ||||||||||||
Assigned: | 2017-11-27 | ||||||||||||
Published: | 2018-01-17 | ||||||||||||
Updated: | 2019-10-09 | ||||||||||||
Summary: | A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to collect customer files via an out-of-band XML External Entity (XXE) injection. An attacker could exploit this vulnerability to gain information to conduct additional reconnaissance attacks. The vulnerability is due to the ability of an attacker to perform an out-of-band XXE injection on the system, which could allow an attacker to capture customer files and redirect them to another destination address. An exploit could allow the attacker to discover sensitive customer data. Cisco Bug IDs: CSCvg36996. | ||||||||||||
CVSS v3 Severity: | 5.3 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) 4.6 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)
4.6 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)
| ||||||||||||
CVSS v2 Severity: | 5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
| ||||||||||||
Vulnerability Type: | CWE-611 | ||||||||||||
Vulnerability Consequences: | Obtain Information | ||||||||||||
References: | Source: MITRE Type: CNA CVE-2018-0108 Source: BID Type: Third Party Advisory, VDB Entry 102720 Source: CCN Type: BID-102720 Cisco WebEx Meetings Server CVE-2018-0108 XML External Entity Information Disclosure Vulnerability Source: SECTRACK Type: Third Party Advisory, VDB Entry 1040238 Source: XF Type: UNKNOWN cisco-wms-cve20180108-info-disc(137712) Source: CCN Type: Cisco Security Advisory cisco-sa-20180117-wms Cisco WebEx Meetings Server Information Disclosure Vulnerability Source: CONFIRM Type: Vendor Advisory https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-wms | ||||||||||||
Vulnerable Configuration: | Configuration 1: Configuration CCN 1: Denotes that component is vulnerable | ||||||||||||
BACK |