User Enumeration in Cisco WebEx Meeting Center Administration Interface

CVE-2015-4194

Summary

The web-based administrative interface of Cisco WebEx Meeting Center reveals distinct error messages for failed login attempts based on the existence of the username and its privileges. This discrepancy enables remote attackers to methodically deduce existing account names and gather sensitive information through repeated trial-and-error login attempts. This flaw can lead to unauthorized access attempts and potential exploitation of account credentials, thus undermining the security of the administrative interface.

References