// For flags

CVE-2018-0287

 

Severity Score

8.8
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. The vulnerability is due to a design flaw in the affected software. An attacker could exploit this vulnerability by sending a user an email attachment or link to a malicious ARF file and persuading the user to open the file or follow the link. A successful exploit could allow the attacker to execute arbitrary code on the user's system. This vulnerability affects Cisco WebEx Business Suite meeting sites, Cisco WebEx Meetings sites, Cisco WebEx Meetings Server, and Cisco WebEx ARF players. Cisco Bug IDs: CSCvh70213, CSCvh70222, CSCvh70228.

Una vulnerabilidad en Cisco WebEx Network Recording Player para archivos Advanced Recording Format (ARF) podría permitir que un atacante remoto no autenticado ejecute código arbitrario en un sistema afectado. La vulnerabilidad se debe a un fallo de diseño en el software afectado. Un atacante podría explotar esta vulnerabilidad mediante el envío al usuario de un enlace o adjunto de email con un archivo ARF malicioso y persuadiéndolo para que siga el enlace o abra el archivo. Una explotación con éxito podría permitir que el atacante ejecute código arbitrario en el sistema del usuario. Esta vulnerabilidad afecta a sitios de reunión Cisco WebEx Business Suite, Cisco WebEx Meetings, Cisco WebEx Meetings Server y a los reproductores Cisco WebEx ARF. Cisco Bug IDs: CSCvh70213, CSCvh70222, CSCvh70228.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2017-11-27 CVE Reserved
  • 2018-05-02 CVE Published
  • 2024-04-11 EPSS Updated
  • 2024-08-05 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Webex Meetings Online
Search vendor "Cisco" for product "Webex Meetings Online"
 t30
Search vendor "Cisco" for product "Webex Meetings Online" and version "t30"
-
Affected
Cisco
Search vendor "Cisco"
 Webex Meetings Online
Search vendor "Cisco" for product "Webex Meetings Online"
 t32.7
Search vendor "Cisco" for product "Webex Meetings Online" and version "t32.7"
-
Affected