CVE-2018-15418

CWE-20 — Improper Input Validation CWE-191 CWE-787 — Out-of-bounds Write4 documents4 sources

Severity

7.8HIGH

EPSS

0.2%

top 55.64%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Webex Business Suite 31 Cisco Webex Business Suite 32 Cisco Webex Business Suite 33 +3 more

Timeline

PublishedOct 5

Latest updateMay 13

Description

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user …

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages6 packages

▶CVEListV5cisco/cisco_webex_wrf_playern/a

▶NVDcisco/webex_meetings_online< 1.3.37

▶NVDcisco/webex_business_suite_31< 31.23.0

▶NVDcisco/webex_business_suite_32< 32.15.10

▶NVDcisco/webex_business_suite_33< 33.5

🔴Vulnerability Details

GHSA

GHSA-9w47-8r5p-3r2p: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an atta↗2022-05-13

▶

CVEList

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities↗2018-10-05

▶

📋Vendor Advisories

Cisco

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities↗2018-10-03

▶