7.8
Élevée
CVE-2018-15442 A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated,…
Description
A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to execute arbitrary commands as a privileged user. The vulnerability is due to insufficient validation of user-supplied parameters. An attacker could exploit this vulnerability by invoking the update service command with a crafted argument. An exploit could allow the attacker to run arbitrary commands with SYSTEM user privileges. While the CVSS Attack Vector metric denotes the requirement for an attacker to have local access, administrators should be aware that in Active Directory deployments, the vulnerability could be exploited remotely by leveraging the operating system remote management tools.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Cisco WebEx Event Center | 33.5.0 | Pas de correctif indiqué |
Références
- 20181024 Cisco Webex Meetings Desktop App Update Service Command Injection Vulnerability tools.cisco.com
- 105734 www.securityfocus.com
- 45696 www.exploit-db.com
- 1041942 www.securitytracker.com
- 45695 www.exploit-db.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Cisco WebEx Event Center
Les 4 CVE de Cisco WebEx Event Center →
CVE-2020-3116
A vulnerability in the way Cisco Webex applications process Universal Communications Format (UCF) files could allow an…
5.5
Moyenne
CVE-2019-15987
A vulnerability in web interface of the Cisco Webex Event Center, Cisco Webex Meeting Center, Cisco Webex Support…
5.3
Moyenne
CVE-2018-15436
A vulnerability in the web-based management interface of Cisco Webex Events Center, Cisco Webex Meeting Center, Cisco…
Non notée