Cross-site scripting in Webex Meetings for Android - CVE-2019-1677
Published: February 7, 2019
Vulnerability identifier: #VU17422
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2019-1677
CWE-ID: CWE-79
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a local authenticated attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data. A local attacker can send a malicious request to the Webex Meetings application through an intent and execute script code in the context of the Webex Meetings application.
Affected software
Webex Meetings for Android
How to mitigate CVE-2019-1677
Install updates from vendor's website.