meetinginfo.do in Cisco WebEx Event Center, WebEx Meeting Center, WebEx Sales Center, WebEx Training Center, WebEx Meetings Server 1.5(.1.13

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• cisco webex business suite27.0
• cisco webex business suite28.0
• cisco webex business suite29.0
• cisco webex event centerall versions
• cisco webex meeting centerall versions
• cisco webex meetings serverup to 1.5\(.1.131\) inclusive
• cisco webex sales centerall versions
• cisco webex training centerall versions

Other highest-scoring records for the same primary product.

• CVE-2018-0104A vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow a remote attacker to execute a
  39Monitor
• CVE-2019-1773Cisco Webex Network Recording Player Arbitrary Code Execution Vulnerabilities
  32Monitor
• CVE-2019-1772Cisco Webex Network Recording Player Arbitrary Code Execution Vulnerability
  32Monitor
• CVE-2018-0103A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow a local attack
  32Monitor
• CVE-2019-15286Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities
  31Monitor
• CVE-2019-15284Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities
  31Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.