CVE-2017-3796
published 2017-01-26CVE-2017-3796: A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to execute predetermined shell commands on other hosts. More…
PriorityP344high7.2CVSS 3.0
AVNACLPRHUINSUCHIHAH
EPSS
1.90%
77.3th percentile
A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to execute predetermined shell commands on other hosts. More Information: CSCuz03353. Known Affected Releases: 2.6.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | webex_meetings_server | — | — |
| cisco | webex_meetings_server | — | — |
CVSS provenance
nvdv3.07.2HIGHCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_cisco5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco WebEx Meetings Server Command Bypass Vulnerability
vendor_cisco·2017-01-18·CVSS 5.4
CVE-2017-3796 [MEDIUM] CWE-78 Cisco WebEx Meetings Server Command Bypass Vulnerability
Cisco WebEx Meetings Server Command Bypass Vulnerability
A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to execute predetermined shell commands on other hosts.
The vulnerability is due to insufficient security configurations of bash in interactive mode. An attacker could exploit this vulnerability by connecting to a host as root and then connecting to another host via SSH and issuing predetermined shell commands. A successful exploit could allow an attacker to execute commands as root on any other Cisco WebEx Meeting Server host.
Cisco has not released software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available.
This advisory is available at the following link: https://sec.cloudapps.cisc
Cisco
Cisco WebEx Meetings Server Command Bypass Vulnerability
vendor_cisco·CVSS 3.0
CVE-2017-3796 Cisco WebEx Meetings Server Command Bypass Vulnerability
CVE-2017-3796: Cisco WebEx Meetings Server Command Bypass Vulnerability
A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to execute predetermined shell commands on other hosts. The vulnerability is due to insufficient security configurations of bash in interactive mode . An attacker could exploit this vulnerability by connecting to a host as root and then connecting to another host via SSH and issuing predetermined shell commands. A successful exploit could allow an attacker to execute commands as root on any other Cisco WebEx Meeting Server host. Cisco has not released software updates that address this vulnerability.
CVSS: 3.0
CWE: CWE-78, CWE-78
Bug IDs: CSCuz03353
GHSA
GHSA-xm73-9p8r-6f5v: A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to execute predetermined shell commands on other hosts
ghsa_unreviewed·2022-05-17
CVE-2017-3796 [HIGH] CWE-78 GHSA-xm73-9p8r-6f5v: A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to execute predetermined shell commands on other hosts
A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to execute predetermined shell commands on other hosts. More Information: CSCuz03353. Known Affected Releases: 2.6.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/95641http://www.securitytracker.com/id/1037651https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170118-wms2http://www.securityfocus.com/bid/95641http://www.securitytracker.com/id/1037651https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170118-wms2
2017-01-26
Published