#VU6085 Information disclosure in Cisco WebEx Meetings Server - CVE-2017-3811

Vulnerability identifier: #VU6085

Vulnerability risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-3811

CWE-ID: CWE-200

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Cisco WebEx Meetings Server
Server applications / Conferencing, Collaboration and VoIP solutions

Vendor: Cisco Systems, Inc

Description
The vulnerability allows a remote attacker to obtain potentially sensitive information.

The vulnerability exists due to improper handling of an XML External Entity (XXE) when parsing an XML file. A remote unauthenticated attacker can trick the victim into opening a specially crafted XML file and gain read access to part of the information stored in the affected system.

Successful exploitation of this vulnerability results in information disclosure.

Mitigation
Update to version 2.7.1.2054.

Vulnerable software versions

Cisco WebEx Meetings Server: 2.6 - 2.7.1.2054

---

External links
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-wms

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.