Cisco WebEx Meetings Server Cross-Site Scripting Vulnerability

A vulnerability within the administrative interface of Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks.

The vulnerability is due to insufficient validation of user-supplied input submitted to an affected device. An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to follow a malicious link or attacker-controlled web page. A successful exploit could allow an attacker to execute arbitrary script or HTML code on the user’s browser within the context of the affected site.

Cisco has confirmed the vulnerability and software updates are available.

To exploit the vulnerability, the attacker may provide a link that directs a user to a malicious website and use misleading language or instructions to persuade the user to follow the link.