Command injection vulnerability in Cisco WebEx Meetings Server



| Updated: 2016-07-18
Risk Medium
Patch available NO
Number of vulnerabilities 1
CVE-ID CVE-2016-1450
CWE-ID CWE-20
Exploitation vector Network
Public exploit N/A
Vulnerable software
Other
Vendor

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Command injection vulnerability

EUVDB-ID: #VU155

Risk: Medium

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2016-1450

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to execute arbitrary commands on the target system.

The vulnerability exists due to the expectation of a certain file type during an upload. A remote authenticated attacker can execute arbitrary commands by injecting specially crafted command arguments.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Patch for this vulnerability id available through the Cisco Bug Search Tool.

Vulnerable software versions

: 2.6

CPE2.3 External links

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160714-wms4


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###