CVE-2018-15421

CWE-20 — Improper Input ValidationCWE-787 — Out-of-bounds Write4 documents4 sources
Severity
7.8HIGH
EPSS
0.2%
top 55.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Cisco Webex Business Suite 32Cisco Webex Business Suite 33Cisco Webex Meetings Online+2 more
Timeline
PublishedOct 5
Latest updateMay 13

Description

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user …

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

▶NVDcisco/webex_meetings_server6 versions+5

🔴Vulnerability Details

2
GHSA
GHSA-jh9c-rrx8-5946: A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an atta↗2022-05-13
▶
CVEList
Cisco Webex Network Recording Player Remote Code Execution Vulnerabilities↗2018-10-05
▶

📋Vendor Advisories

1
Cisco
Cisco Webex Network Recording Player Remote Code Execution Vulnerabilities↗2018-09-19
▶