CVE-2023-20180
published 2023-07-07CVE-2023-20180: A vulnerability in the web interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF)…
PriorityP423medium4.3CVSS 3.1
AVNACLPRNUIRSUCNILAN
EPSS
0.39%
30.8th percentile
A vulnerability in the web interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.
This vulnerability is due to insufficient CSRF protections for the web interface on an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions. These actions could include joining meetings and scheduling training sessions.
Affected
65 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
| cisco | cisco_webex_meetings | — | — |
CVSS provenance
nvdv3.14.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
vendor_cisco5.4MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Webex Meetings Web UI Vulnerabilities
vendor_cisco·2023-07-05·CVSS 5.4
CVE-2023-20133 [MEDIUM] CWE-352 Cisco Webex Meetings Web UI Vulnerabilities
Cisco Webex Meetings Web UI Vulnerabilities
Multiple vulnerabilities in the web UI of Cisco Webex Meetings could allow a remote attacker to conduct stored cross-site scripting (XSS) or cross-site request forgery (CSRF) attacks.
For more information about these vulnerabilities, see the Details section of this advisory.
Cisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sxsscsrf-2L24bBx6
Cisco
Cisco Webex Meetings Web UI Vulnerabilities
vendor_cisco·CVSS 3.1
CVE-2023-20180 Cisco Webex Meetings Web UI Vulnerabilities
CVE-2023-20180: Cisco Webex Meetings Web UI Vulnerabilities
Multiple vulnerabilities in the web UI of Cisco Webex Meetings could allow a remote attacker to conduct stored cross-site scripting (XSS) or cross-site request forgery (CSRF) attacks. For more information about these vulnerabilities, see the
CVSS: 3.1
CWE: CWE-352, CWE-79, CWE-352, CWE-79
Bug IDs: CSCwe38545, CSCwe64524, CSCwe38545, CSCwe64524
GHSA
GHSA-q3fh-c732-57w2: A vulnerability in the web interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (
ghsa_unreviewed·2023-07-07
CVE-2023-20180 [MEDIUM] CWE-352 GHSA-q3fh-c732-57w2: A vulnerability in the web interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (
A vulnerability in the web interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack on an affected system.
This vulnerability is due to insufficient CSRF protections for the web interface on an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to perform arbitrary actions. These actions could include joining meetings and scheduling training sessions.
GHSA
xwiki contains Exposed Dangerous Method or Function
ghsa·2023-03-03
CVE-2023-26478 [MEDIUM] CWE-749 xwiki contains Exposed Dangerous Method or Function
xwiki contains Exposed Dangerous Method or Function
### Impact
`org.xwiki.store.script.TemporaryAttachmentsScriptService#uploadTemporaryAttachment` is returning an instance of `com.xpn.xwiki.doc.XWikiAttachment`. This class is not supported to be exposed to users without the `programing` right.
`com.xpn.xwiki.api.Attachment` should be used instead and takes case of checking the user's rights before performing dangerous operations.
### Patches
This has been patched in the version 14.9-rc-1 and 14.4.6.
### Workarounds
There's no workaround for this issue.
### References
https://jira.xwiki.org/browse/XWIKI-20180
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [JIRA](https://jira.xwiki.org/)
* Email us at [security ML](mailto:securit
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-07-07
Published