DOM-based XSS Vulnerability in Cisco Webex Web Framework
CVE-2018-0390

6.1MEDIUM

Key Information:

Vendor
Cisco
Status
Cisco Webex Unknown
Vendor
CVE Published:
18 July 2018

Summary

A vulnerability in the web framework of Cisco Webex enables unauthenticated, remote attackers to perform DOM-based cross-site scripting (XSS) attacks. This occurs due to inadequate input validation of parameters submitted via the HTTP POST method. By exploiting this flaw, attackers can inject malicious scripts into the affected web interface, potentially executing arbitrary HTML or script code in the browser of a user interacting with the compromised element, leading to data exposure or further attacks. To mitigate this risk, it is crucial to implement proper input validation and security controls.

Affected Version(s)

Cisco Webex unknown Cisco Webex unknown

References

https://tools.cisco.com/security/center/content/CiscoSecu...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/104865
vdb-entryx_refsource_BID

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.