CVE-2017-6651
HighSummary
A vulnerability in Cisco WebEx Meetings Server could allow unauthenticated, remote attackers to gain information about scheduled customer meetings. The issue is due to an incomplete configuration of the robots.txt file on customer-hosted WebEx solutions.
Risk Assessment
Attackers could exploit this vulnerability to obtain information about scheduled meetings, potentially leading to unauthorized attendance at those meetings.
Recommendation
It is recommended to update Cisco WebEx Meetings Server to a version later than 2.5MR4 and properly configure the robots.txt file to minimize risk.
Other vulnerabilities in Cisco WebEx Meetings Server
See all- CVE-2014-0691High
Cisco WebEx Meetings Server before version 1.1 uses meeting IDs with insufficient entropy, allowing remote attackers to bypass authentication and join arbitrary meetings without a password.
- CVE-2017-12293High
A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The vulnerability is due to insufficient limitations on the number of connections that can be made to the affected software.
- CVE-2017-3796High
A vulnerability in Cisco WebEx Meetings Server allows an authenticated, remote attacker to execute predetermined shell commands on other hosts.
- CVE-2017-3794High
A vulnerability in Cisco WebEx Meetings Server allows an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack against an administrative user.
- CVE-2016-1483High
Cisco WebEx Meetings Server version 2.6 allows remote attackers to cause a denial of service (CPU consumption) by repeatedly accessing the account-validation component of an unspecified service.
- CVE-2016-1482High
Cisco WebEx Meetings Server version 2.6 allows remote attackers to execute arbitrary commands by injecting these commands into an application script.
- CVE-2016-1484High
Cisco WebEx Meetings Server version 2.6 allows remote attackers to bypass intended access restrictions and obtain sensitive application information via unspecified vectors.
- CVE-2016-1448High
CSRF vulnerability in Cisco WebEx Meetings Server 2.7 allows remote attackers to hijack the authentication of arbitrary users.
- CVE-2016-1450High
Cisco WebEx Meetings Server version 2.6 allows remote authenticated users to conduct command-injection attacks via file type related to uploads, known as Bug ID CSCuy92715.
- CVE-2016-1446High
SQL injection vulnerability in Cisco WebEx Meetings Server 2.6 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.
Original NVD description (English source)
A vulnerability in Cisco WebEx Meetings Server could allow unauthenticated, remote attackers to gain information that could allow them to access scheduled customer meetings. The vulnerability is due to an incomplete configuration of the robots.txt file on customer-hosted WebEx solutions and occurs when the Short URL functionality is not activated. All releases of Cisco WebEx Meetings Server later than release 2.5MR4 provide this functionality. An attacker could exploit this vulnerability via an exposed parameter to search for indexed meeting information. A successful exploit could allow the attacker to obtain scheduled meeting information and potentially allow the attacker to attend scheduled, customer meetings. This vulnerability affects the following releases of Cisco WebEx Meetings Server: 2.5, 2.6, 2.7, 2.8. Cisco Bug IDs: CSCve25950.