Lucene search

CiscoCVE-2018-15410

HistoryOct 05, 2018 - 2:29 p.m.

CVE-2018-15410

2018-10-0514:29:09

CWE-20

cisco

web.nvd.nist.gov

cisco

webex

network

recording

player

microsoft

windows

vulnerability

cve-2018-15410

nvd

code execution

arf

wrf

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

62.2%

JSON

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

Affected configurations

Nvd

Node

ciscowebex_meetings_onlineRange<1.3.37

Node

ciscowebex_meetings_serverMatch2.5maintenance_release2_patch1

ciscowebex_meetings_serverMatch2.5maintenance_release5_patch1

ciscowebex_meetings_serverMatch2.5maintenance_release6_patch2

ciscowebex_meetings_serverMatch2.5maintenance_release6_patch3

ciscowebex_meetings_serverMatch2.5maintenance_release6_patch4

ciscowebex_meetings_serverMatch2.5.1.29

ciscowebex_meetings_serverMatch2.6

ciscowebex_meetings_serverMatch2.6maintenance_release1_patch1

ciscowebex_meetings_serverMatch2.6maintenance_release2_patch1

ciscowebex_meetings_serverMatch2.6maintenance_release3_patch1

ciscowebex_meetings_serverMatch2.6maintenance_release3_patch2

ciscowebex_meetings_serverMatch2.7

ciscowebex_meetings_serverMatch2.7base

ciscowebex_meetings_serverMatch2.7maintenance_release1_patch1

ciscowebex_meetings_serverMatch2.7maintenance_release2_patch1

ciscowebex_meetings_serverMatch2.7.1

ciscowebex_meetings_serverMatch2.8

ciscowebex_meetings_serverMatch2.8base

Node

ciscowebex_business_suite_32Range<32.15.10

Node

ciscowebex_business_suite_33Range<33.5

Node

ciscowebex_business_suite_31Range<31.23.0

VendorProductVersionCPE
ciscowebex_meetings_online*cpe:2.3:a:cisco:webex_meetings_online:*:*:*:*:*:*:*:*
ciscowebex_meetings_server2.5cpe:2.3:a:cisco:webex_meetings_server:2.5:maintenance_release2_patch1:*:*:*:*:*:*
ciscowebex_meetings_server2.5cpe:2.3:a:cisco:webex_meetings_server:2.5:maintenance_release5_patch1:*:*:*:*:*:*
ciscowebex_meetings_server2.5cpe:2.3:a:cisco:webex_meetings_server:2.5:maintenance_release6_patch2:*:*:*:*:*:*
ciscowebex_meetings_server2.5cpe:2.3:a:cisco:webex_meetings_server:2.5:maintenance_release6_patch3:*:*:*:*:*:*
ciscowebex_meetings_server2.5cpe:2.3:a:cisco:webex_meetings_server:2.5:maintenance_release6_patch4:*:*:*:*:*:*
ciscowebex_meetings_server2.5.1.29cpe:2.3:a:cisco:webex_meetings_server:2.5.1.29:*:*:*:*:*:*:*
ciscowebex_meetings_server2.6cpe:2.3:a:cisco:webex_meetings_server:2.6:*:*:*:*:*:*:*
ciscowebex_meetings_server2.6cpe:2.3:a:cisco:webex_meetings_server:2.6:maintenance_release1_patch1:*:*:*:*:*:*
ciscowebex_meetings_server2.6cpe:2.3:a:cisco:webex_meetings_server:2.6:maintenance_release2_patch1:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	webex_meetings_online	*	cpe:2.3:a:cisco:webex_meetings_online::::::::
cisco	webex_meetings_server	2.5	cpe:2.3:a:cisco:webex_meetings_server:2.5:maintenance_release2_patch1::::::
cisco	webex_meetings_server	2.5	cpe:2.3:a:cisco:webex_meetings_server:2.5:maintenance_release5_patch1::::::
cisco	webex_meetings_server	2.5	cpe:2.3:a:cisco:webex_meetings_server:2.5:maintenance_release6_patch2::::::
cisco	webex_meetings_server	2.5	cpe:2.3:a:cisco:webex_meetings_server:2.5:maintenance_release6_patch3::::::
cisco	webex_meetings_server	2.5	cpe:2.3:a:cisco:webex_meetings_server:2.5:maintenance_release6_patch4::::::
cisco	webex_meetings_server	2.5.1.29	cpe:2.3:a:cisco:webex_meetings_server:2.5.1.29:::::::*
cisco	webex_meetings_server	2.6	cpe:2.3:a:cisco:webex_meetings_server:2.6:::::::*
cisco	webex_meetings_server	2.6	cpe:2.3:a:cisco:webex_meetings_server:2.6:maintenance_release1_patch1::::::
cisco	webex_meetings_server	2.6	cpe:2.3:a:cisco:webex_meetings_server:2.6:maintenance_release2_patch1::::::

Rows per page:

1-10 of 221

CNA Affected

[
  {
    "product": "Cisco WebEx WRF Player",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]

References

www.securityfocus.com/bid/105520

www.securitytracker.com/id/1041795

tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-webex-rce

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

62.2%

JSON

Related for CVE-2018-15410