CVE-2018-0436: Cisco Webex Teams Information Disclosure and Modification Vulnerability
First published: Fri Oct 05 2018(Updated: )
A vulnerability in Cisco Webex Teams, formerly Cisco Spark, could allow an authenticated, remote attacker to view and modify data for an organization other than their own organization. The vulnerability exists because the affected software performs insufficient checks for associations between user accounts and organization accounts. An attacker who has administrator or compliance officer privileges for one organization account could exploit this vulnerability by using those privileges to view and modify data for another organization account. No customer data was impacted by this vulnerability.
Credit: ykramarz@cisco.com ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Webex Teams | <20180417-150803 | |
| Cisco Webex Teams | <10.6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Cisco Webex Teams vulnerability?
The vulnerability ID for this Cisco Webex Teams vulnerability is CVE-2018-0436.
What is the severity of CVE-2018-0436?
The severity of CVE-2018-0436 is high.
What is the affected software for CVE-2018-0436?
The affected software for CVE-2018-0436 is Cisco Webex Teams.
How can an authenticated remote attacker exploit CVE-2018-0436?
An authenticated remote attacker can exploit CVE-2018-0436 to view and modify data for an organization other than their own organization.
Where can I find more information about CVE-2018-0436?
You can find more information about CVE-2018-0436 on the Cisco Security Advisory website and the SecurityFocus website.
- collector/nvd-index
- agent/weakness
- agent/references
- agent/type
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/author
- agent/severity
- agent/softwarecombine
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/event
- agent/first-publish-date
- agent/tags
- vendor/cisco
- canonical/cisco webex teams