SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Generic)  >   Cisco WebEx Meeting Center Vendors:   Cisco
Cisco WebEx Meeting Center Multiple Flaws Let Remote Users Conduct Cross-Site Scripting, SQL Injection, and Information Disclosure Attacks
SecurityTracker Alert ID:  1032705
SecurityTracker URL:  http://securitytracker.com/id/1032705
CVE Reference:   CVE-2015-4207, CVE-2015-4208, CVE-2015-4209, CVE-2015-4210, CVE-2015-4212   (Links to External Site)
Date:  Jun 24 2015
Impact:   Disclosure of authentication information, Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   Multiple vulnerabilities were reported in Cisco WebEx Meeting Center. A remote user can conduct cross-site scripting attacks. A remote user can inject SQL commands. A remote user can obtain potentially sensitive information on the target system.

The software does not properly filter HTML code from user-supplied input before displaying the input [CVE-2015-4210]. A remote user can create a specially crafted URL that, when loaded by a target user, will cause arbitrary scripting code to be executed by the target user's browser. The code will originate from the site running the Cisco WebEx Meeting Center software and will run in the security context of that site. As a result, the code will be able to access the target user's cookies (including authentication cookies), if any, associated with the site, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

The vendor has assigned bug ID CSCur03806 to this vulnerability.

A remote user can supply a specially crafted parameter value to execute SQL commands on the underlying database [CVE-2015-4208].

The vendor has assigned bug ID CSCup88398 to this vulnerability.

A remote user can exploit an access control flaw to access potentially sensitive data and authentication credentials [CVE-2015-4212]. Cisco Hosted WebEx Meeting Center is affected.

The vendor has assigned bug ID CSCut17466 to this vulnerability.

A remote user can access sensitive information in URLs and obtain the meeting access number from the target device [CVE-2015-4207]. As a result, the remote user can connect to a WebEx meeting without registering to attend.

The vendor has assigned bug ID CSCus62147 to this vulnerability.

A remote user can enumerate scheduled meetings and download the host calendar for each meeting [CVE-2015-4209].

The vendor has assigned bug ID CSCur23913 to this vulnerability.

Cisco Hosted WebEx Meeting Center is affected by these vulnerabilities.

Impact:   A remote user can access the target user's cookies (including authentication cookies), if any, associated with the site running the Cisco WebEx Meeting Center software, access data recently submitted by the target user via web form to the site, or take actions on the site acting as the target user.

A remote user can execute SQL commands on the underlying database.

A remote user can attend a meeting without registering.

A remote user can access potentially sensitive data and authentication credentials.

Solution:   The vendor has issued a fix.

The vendor's advisories are available at:

http://tools.cisco.com/security/center/viewAlert.x?alertId=39457
http://tools.cisco.com/security/center/viewAlert.x?alertId=39458
http://tools.cisco.com/security/center/viewAlert.x?alertId=39459
http://tools.cisco.com/security/center/viewAlert.x?alertId=39460
http://tools.cisco.com/security/center/viewAlert.x?alertId=39467

Vendor URL:  tools.cisco.com/security/center/viewAlert.x?alertId=39457 (Links to External Site)
Cause:   Access control error, Input validation error

Message History:   None.


 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC