CVE-2018-0108: XEE

Published Jan 18, 2018

Updated

A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to collect customer files via an out-of-band XML External Entity (XXE) injection. An attacker could exploit this vulnerability to gain information to conduct additional reconnaissance attacks. The vulnerability is due to the ability of an attacker to perform an out-of-band XXE injection on the system, which could allow an attacker to capture customer files and redirect them to another destination address. An exploit could allow the attacker to discover sensitive customer data. Cisco Bug IDs: CSCvg36996.

Affected Software

1 affected component

Cisco Webex Meetings Server

Event History

Jan 18, 2018

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-0108?

CVE-2018-0108 is classified as a medium severity vulnerability.

How do I fix CVE-2018-0108?

To mitigate CVE-2018-0108, update to the latest version of Cisco WebEx Meetings Server that addresses this vulnerability.

Who is affected by CVE-2018-0108?

CVE-2018-0108 affects users of Cisco WebEx Meetings Server.

What type of attack can be executed with CVE-2018-0108?

CVE-2018-0108 allows an attacker to perform an out-of-band XML External Entity (XXE) injection.

What information can be collected through CVE-2018-0108?

Exploitation of CVE-2018-0108 can lead to the unauthorized collection of customer files.