Improper input validation in Cisco WebEx Meeting Center - CVE-2017-12297

Vulnerability identifier: #VU9493

CSH Severity: Low

CVSS v4: 2.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-12297

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated attacker to initiate connections to arbitrary hosts.

The vulnerability exists due to insufficient access control for HTTP traffic directed to the Cisco WebEx Meeting Center. A remote attacker can send a malicious URL to the Cisco WebEx Meeting Center and connect to arbitrary hosts.

Cisco WebEx Meeting Center
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
thunderbird (Red Hat package)

The vulnerability is addressed in the following versions: 32.8, 32.6, 31.20.

thunderbird (Red Hat package) - update to 115.13.0-3.el8_8

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171129-wmc

• Multiple vulnerabilities in Cisco WebEx Meeting Center
• Red Hat Enterprise Linux 8 update for thunderbird