CVE-2018-0436
published 2018-10-05CVE-2018-0436: A vulnerability in Cisco Webex Teams, formerly Cisco Spark, could allow an authenticated, remote attacker to view and modify data for an organization other…
PriorityP349high8.7CVSS 3.1
AVNACLPRHUINSCCHIHAN
EPSS
1.28%
66.8th percentile
A vulnerability in Cisco Webex Teams, formerly Cisco Spark, could allow an authenticated, remote attacker to view and modify data for an organization other than their own organization. The vulnerability exists because the affected software performs insufficient checks for associations between user accounts and organization accounts. An attacker who has administrator or compliance officer privileges for one organization account could exploit this vulnerability by using those privileges to view and modify data for another organization account. No customer data was impacted by this vulnerability.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_webex_teams | — | — |
| cisco | webex_teams | < 10.6.0 | 10.6.0 |
| cisco | webex_teams | — | — |
CVSS provenance
nvdv3.18.7HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
nvdv2.05.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:N
vendor_cisco8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Webex Teams Information Disclosure and Modification Vulnerability
vendor_cisco·2018-09-05·CVSS 8.7
CVE-2018-0436 [HIGH] CWE-284 Cisco Webex Teams Information Disclosure and Modification Vulnerability
Cisco Webex Teams Information Disclosure and Modification Vulnerability
A vulnerability in Cisco Webex Teams, formerly Cisco Spark, could allow an authenticated, remote attacker to view and modify data for an organization other than their own organization.
The vulnerability exists because the affected software performs insufficient checks for associations between user accounts and organization accounts. An attacker who has administrator or compliance officer privileges for one organization account could exploit this vulnerability by using those privileges to view and modify data for another organization account.
No customer data was impacted by this vulnerability.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
Cisco
Cisco Webex Teams Information Disclosure and Modification Vulnerability
vendor_cisco·CVSS 3.0
CVE-2018-0436 Cisco Webex Teams Information Disclosure and Modification Vulnerability
CVE-2018-0436: Cisco Webex Teams Information Disclosure and Modification Vulnerability
A vulnerability in Cisco Webex Teams, formerly Cisco Spark, could allow an authenticated, remote attacker to view and modify data for an organization other than their own organization. The vulnerability exists because the affected software performs insufficient checks for associations between user accounts and organization accounts. An attacker who has administrator or compliance officer privileges for one organization account could exploit this vulnerability by using those privileges to view and modify data for another organization account. No customer data was impacted by this vulnerability. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.0
CWE: CWE-284, CWE-28
GHSA
GHSA-jr8m-x5pc-vrvr: A vulnerability in Cisco Webex Teams, formerly Cisco Spark, could allow an authenticated, remote attacker to view and modify data for an organization
ghsa_unreviewed·2022-05-13
CVE-2018-0436 [HIGH] CWE-269 GHSA-jr8m-x5pc-vrvr: A vulnerability in Cisco Webex Teams, formerly Cisco Spark, could allow an authenticated, remote attacker to view and modify data for an organization
A vulnerability in Cisco Webex Teams, formerly Cisco Spark, could allow an authenticated, remote attacker to view and modify data for an organization other than their own organization. The vulnerability exists because the affected software performs insufficient checks for associations between user accounts and organization accounts. An attacker who has administrator or compliance officer privileges for one organization account could exploit this vulnerability by using those privileges to view and modify data for another organization account. No customer data was impacted by this vulnerability.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2018-10-05
Published