Cisco Webex Meetings
Monthly
Improper certificate validation in the SSO integration with Control Hub for Cisco Webex Services allowed unauthenticated remote attackers to impersonate any user by supplying a crafted token to a service endpoint. This authentication bypass enables full unauthorized access to Cisco Webex meetings, messaging, and related resources. While no active exploitation or public exploit code is known, the high severity and low attack complexity merit immediate attention.
Cross-site scripting in Cisco Webex Meetings' web-based UI allowed unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by persuading them to follow a crafted malicious link. Insufficient input validation (CWE-79) in the Webex Meetings web interface is the root cause; the Changed Scope (S:C) in the CVSS vector indicates impact extends beyond the Webex application into the broader browser context, enabling session theft or browser-based data access. Cisco has fully remediated this server-side in the Webex cloud service, and no customer action is required. No public exploit code identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Improper certificate validation in the SSO integration with Control Hub for Cisco Webex Services allowed unauthenticated remote attackers to impersonate any user by supplying a crafted token to a service endpoint. This authentication bypass enables full unauthorized access to Cisco Webex meetings, messaging, and related resources. While no active exploitation or public exploit code is known, the high severity and low attack complexity merit immediate attention.
Cross-site scripting in Cisco Webex Meetings' web-based UI allowed unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by persuading them to follow a crafted malicious link. Insufficient input validation (CWE-79) in the Webex Meetings web interface is the root cause; the Changed Scope (S:C) in the CVSS vector indicates impact extends beyond the Webex application into the broader browser context, enabling session theft or browser-based data access. Cisco has fully remediated this server-side in the Webex cloud service, and no customer action is required. No public exploit code identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.