CVE-2019-15987: A vulnerability in web interface of the Cisco Webex Event Center, Cisco Webex Meeting Center, Cisco Webex Support Center, and Cisco Webex Training Center could allow an…

Description

A vulnerability in web interface of the Cisco Webex Event Center, Cisco Webex Meeting Center, Cisco Webex Support Center, and Cisco Webex Training Center could allow an unauthenticated, remote attacker to guess account usernames. The vulnerability is due to missing CAPTCHA protection in certain URLs. An attacker could exploit this vulnerability by sending a crafted request to the web interface. A successful exploit could allow the attacker to know if a given username is valid and find the real name of the user.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

Low

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.6% · higher than 75% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

WE

Webex Event Center · Cisco

All versions, or not specified · source: NVD

WM

Webex Meeting Center · Cisco

All versions, or not specified · source: NVD

WM

Webex Meetings Online · Cisco

11.0.0 · source: NVD

WM

Webex Meetings Server · Cisco

4.0 · source: NVD

WS

Webex Support Center · Cisco

All versions, or not specified · source: NVD

WT

Webex Training Center · Cisco

All versions, or not specified · source: NVD