7.5

CVE-2017-6651

A vulnerability in Cisco WebEx Meetings Server could allow unauthenticated, remote attackers to gain information that could allow them to access scheduled customer meetings. The vulnerability is due to an incomplete configuration of the robots.txt file on customer-hosted WebEx solutions and occurs when the Short URL functionality is not activated. All releases of Cisco WebEx Meetings Server later than release 2.5MR4 provide this functionality. An attacker could exploit this vulnerability via an exposed parameter to search for indexed meeting information. A successful exploit could allow the attacker to obtain scheduled meeting information and potentially allow the attacker to attend scheduled, customer meetings. This vulnerability affects the following releases of Cisco WebEx Meetings Server: 2.5, 2.6, 2.7, 2.8. Cisco Bug IDs: CSCve25950.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cisco ≫ Webex Meetings Server Version2.5.1.5
Cisco ≫ Webex Meetings Server Version2.5.1.29
Cisco ≫ Webex Meetings Server Version2.5.99.2
Cisco ≫ Webex Meetings Server Version2.5_base
Cisco ≫ Webex Meetings Server Version2.5_mr1
Cisco ≫ Webex Meetings Server Version2.5_mr2
Cisco ≫ Webex Meetings Server Version2.5_mr2 Updatepatch1
Cisco ≫ Webex Meetings Server Version2.5_mr3
Cisco ≫ Webex Meetings Server Version2.5_mr4
Cisco ≫ Webex Meetings Server Version2.5_mr5
Cisco ≫ Webex Meetings Server Version2.5_mr5 Updatepatch1
Cisco ≫ Webex Meetings Server Version2.5_mr6
Cisco ≫ Webex Meetings Server Version2.5_mr6 Updatepatch_1
Cisco ≫ Webex Meetings Server Version2.5_mr6 Updatepatch2
Cisco ≫ Webex Meetings Server Version2.5_mr6 Updatepatch3
Cisco ≫ Webex Meetings Server Version2.5_mr6 Updatepatch4
Cisco ≫ Webex Meetings Server Version2.6.0
Cisco ≫ Webex Meetings Server Version2.6.1.39
Cisco ≫ Webex Meetings Server Version2.6_mr1
Cisco ≫ Webex Meetings Server Version2.6_mr1 Updatepatch1
Cisco ≫ Webex Meetings Server Version2.6_mr2
Cisco ≫ Webex Meetings Server Version2.6_mr2 Updatepatch1
Cisco ≫ Webex Meetings Server Version2.6_mr3
Cisco ≫ Webex Meetings Server Version2.6_mr3 Updatepatch1
Cisco ≫ Webex Meetings Server Version2.6_mr3 Updatepatch2
Cisco ≫ Webex Meetings Server Version2.7.1
Cisco ≫ Webex Meetings Server Version2.7_base
Cisco ≫ Webex Meetings Server Version2.7_mr1
Cisco ≫ Webex Meetings Server Version2.7_mr1 Updatepatch1
Cisco ≫ Webex Meetings Server Version2.7_mr2
Cisco ≫ Webex Meetings Server Version2.7_mr2 Updatepatch1
Cisco ≫ Webex Meetings Server Version2.8_base
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.44% 0.601
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://www.securityfocus.com/bid/98387
Third Party Advisory
VDB Entry