Information disclosure in Cisco WebEx Event Center - CVE-2017-12365
Published: December 1, 2017
Vulnerability identifier: #VU9494
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-12365
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information on the target system.
The weakness exists due to a design flaw in the product. A remote attacker can execute a query on an Event Center site to view scheduled meetings, view both listed and unlisted meetings in the displayed information and attend meetings that are not available for their attendance.
Affected software
Cisco WebEx Event Center
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
thunderbird (Red Hat package)
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
thunderbird (Red Hat package)
How to mitigate CVE-2017-12365
Install update from vendor's website.
thunderbird (Red Hat package) - update to 115.13.0-3.el8_8