CVE-2016-1450
published 2016-07-15CVE-2016-1450: Cisco WebEx Meetings Server 2.6 allows remote authenticated users to conduct command-injection attacks via vectors related to an upload's file type, aka Bug ID…
PriorityP342high7.5CVSS 3.0
AVNACHPRLUINSUCHIHAH
EPSS
1.25%
66.4th percentile
Cisco WebEx Meetings Server 2.6 allows remote authenticated users to conduct command-injection attacks via vectors related to an upload's file type, aka Bug ID CSCuy92715.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | webex_meetings_server | — | — |
| cisco | webex_meetings_server | — | — |
| cisco | webex_meetings_server | — | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
vendor_cisco4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco WebEx Meetings Server Command Injection Vulnerability
vendor_cisco·2016-07-14·CVSS 4.9
CVE-2016-1450 [MEDIUM] CWE-20 Cisco WebEx Meetings Server Command Injection Vulnerability
Cisco WebEx Meetings Server Command Injection Vulnerability
A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to perform a command injection attack.
The vulnerability occurs due to the expectation of a certain file type during an upload. An attacker could exploit this vulnerability by using crafted command arguments on the system. An exploit could allow the attacker to perform a command injection attack, which could allow the attacker to execute arbitrary commands on the system.
Cisco released software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available.
This advisory is available at the following link: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-201
Cisco
Cisco WebEx Meetings Server Command Injection Vulnerability
vendor_cisco
CVE-2016-1450 Cisco WebEx Meetings Server Command Injection Vulnerability
CVE-2016-1450: Cisco WebEx Meetings Server Command Injection Vulnerability
A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to perform a command injection attack. The vulnerability occurs due to the expectation of a certain file type during an upload. An attacker could exploit this vulnerability by using crafted command arguments on the system. An exploit could allow the attacker to perform a command injection attack, which could allow the attacker to execute arbitrary commands on the system. Cisco released software updates that address this vulnerability.
CWE: CWE-20, CWE-20
Bug IDs: CSCuy92715
GHSA
GHSA-5768-4xxg-h24c: Cisco WebEx Meetings Server 2
ghsa_unreviewed·2022-05-17
CVE-2016-1450 [HIGH] CWE-20 GHSA-5768-4xxg-h24c: Cisco WebEx Meetings Server 2
Cisco WebEx Meetings Server 2.6 allows remote authenticated users to conduct command-injection attacks via vectors related to an upload's file type, aka Bug ID CSCuy92715.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160714-wms4http://www.securityfocus.com/bid/91779http://www.securitytracker.com/id/1036315http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160714-wms4http://www.securityfocus.com/bid/91779http://www.securitytracker.com/id/1036315
2016-07-15
Published