Lucene search

CiscoCVE-2018-15431

HistoryOct 05, 2018 - 2:29 p.m.

CVE-2018-15431

2018-10-0514:29:11

CWE-787

CWE-20

cisco

web.nvd.nist.gov

cve-2018-15431

cisco

webex

network recording player

microsoft windows

vulnerability

arbitrary code

arf

wrf

exploit

nvd

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

27.5%

JSON

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

Affected configurations

Nvd

Node

ciscowebex_meetings_serverMatch3.0-

ciscowebex_meetings_serverMatch3.0maintenance_release1

ciscowebex_meetings_serverMatch3.0maintenance_release2_patch1

Node

ciscowebex_meetings_onlineRange<1.3.38

Node

ciscowebex_business_suite_32Range<32.15.30

VendorProductVersionCPE
ciscowebex_meetings_server3.0cpe:2.3:a:cisco:webex_meetings_server:3.0:-:*:*:*:*:*:*
ciscowebex_meetings_server3.0cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release1:*:*:*:*:*:*
ciscowebex_meetings_server3.0cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release2_patch1:*:*:*:*:*:*
ciscowebex_meetings_online*cpe:2.3:a:cisco:webex_meetings_online:*:*:*:*:*:*:*:*
ciscowebex_business_suite_32*cpe:2.3:a:cisco:webex_business_suite_32:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	webex_meetings_server	3.0	cpe:2.3:a:cisco:webex_meetings_server:3.0:-::::::
cisco	webex_meetings_server	3.0	cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release1::::::
cisco	webex_meetings_server	3.0	cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release2_patch1::::::
cisco	webex_meetings_online	*	cpe:2.3:a:cisco:webex_meetings_online::::::::
cisco	webex_business_suite_32	*	cpe:2.3:a:cisco:webex_business_suite_32::::::::

CNA Affected

[
  {
    "product": "Cisco WebEx WRF Player",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

www.securityfocus.com/bid/105520

www.securitytracker.com/id/1041795

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-webex-rce

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

27.5%

JSON

Related for CVE-2018-15431