SB2016071503 - SQL injection in Cisco WebEx Meetings Server. in Cisco WebEx Meetings Server
Published: July 15, 2016 Updated: July 18, 2016
Security Bulletin ID
SB2016071503
CSH Severity
Medium
Patch available
NO
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) SQL injection in Cisco WebEx Meetings Server. (CVE-ID: CVE-2016-1446)
CWE-ID: CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to inject SQL commands.
The vulnerability exists due to a lack of input validation on user-supplied input in SQL queries. A remote authenticated attacker can execute SQL commands by sending crafted URLs that contain malicious SQL statements to the affected system.
Successful exploitation of this vulnerability may result in disclosure of system information.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.