Cisco WebEx Meetings Server Information Disclosure Vulnerability

A vulnerability in the Cisco WebEx Event Center module of the Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to gather event passwords and host keys.

The vulnerability is due to a failure to authenticate some user requests. An attacker could exploit this vulnerability by sending specially crafted URLs to the Cisco WebEx Meeting Server.

Cisco has confirmed the vulnerability in a Security Notice. Software updates are available.

To exploit the vulnerability, the attacker may provide a link to a malicious site and may persuade the user to follow the link by using misleading language and instructions.

Customers are advised to review the bug report in the “Vendor Announcements” section for a current list of affected versions.