Cisco WebEx Meeting Center allows remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by discovering c

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• cisco webex meeting centerall versions

Other highest-scoring records for the same primary product.

• CVE-2016-1410Cisco WebEx Meeting Center Original Release Base allows remote attackers to obtain sensitive information about username validity by (1) atte
  31Monitor
• CVE-2015-4208Cisco WebEx Meeting Center does not properly restrict the content of URLs in GET requests, which allows remote attackers to obtain sensitive
  31Monitor
• CVE-2010-3270Stack-based buffer overflow in Cisco WebEx Meeting Center T27LB before SP21 EP3 and T27LC before SP22 allows user-assisted remote authentica
  28Monitor
• CVE-2017-12359A Buffer Overflow vulnerability in Cisco WebEx Network Recording Player for Advanced Recording Format (.arf) files could allow an attacker t
  27Monitor
• CVE-2015-4209Cisco WebEx Meeting Center does not properly determine authorization for reading a host calendar, which allows remote attackers to obtain se
  26Monitor
• CVE-2017-12366A vulnerability in Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack
  24Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.