CVE-2018-0108
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to collect customer files via an out-of-band XML External Entity (XXE) injection. An attacker could exploit this vulnerability to gain information to conduct additional reconnaissance attacks. The vulnerability is due to the ability of an attacker to perform an out-of-band XXE injection on the system, which could allow an attacker to capture customer files and redirect them to another destination address. An exploit could allow the attacker to discover sensitive customer data. Cisco Bug IDs: CSCvg36996.
Una vulnerabilidad en Cisco WebEx Meetings Server podría permitir que un atacante remoto no autenticado obtenga archivos de clientes mediante una inyección de XEE (XML External Entity) fuera de banda. Un atacante podría explotar esta vulnerabilidad para obtener información y realizar ataques adicionales de reconocimiento. La vulnerabilidad se debe a la capacidad de un atacante para realizar una inyección XEE (XML External Entity) fuera de banda en el sistema, lo que podría permitir que un atacante capture archivos de clientes y los redirija a otra dirección de destino. Esta vulnerabilidad podría permitir que el atacante descubra datos sensibles de clientes. Cisco Bug IDs: CSCvg36996.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-11-27 CVE Reserved
- 2018-01-18 CVE Published
- 2023-07-21 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-611: Improper Restriction of XML External Entity Reference
CAPEC
References (3)
URL | Tag | Source |
---|---|---|
http://www.securityfocus.com/bid/102720 | Third Party Advisory | |
http://www.securitytracker.com/id/1040238 | Third Party Advisory |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180117-wms | 2019-10-09 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Cisco Search vendor "Cisco" | Webex Meetings Server Search vendor "Cisco" for product "Webex Meetings Server" | * | - |
Affected
|