Cisco Webex Network Recording Admin Page Privilege Escalation Vulnerability (Cisco Cisco Webex Meetings)

CVE-2019-15960
MEDIUM 5.4

At a glance

Source
NVD
EPSS
EPSS 1.14 % · percentile 67 ()
State
PUBLISHED
Published
Updated
Assigner
cisco
NVD status
Modified

Description

A vulnerability in the Webex Network Recording Admin page of Cisco Webex Meetings could allow an authenticated, remote attacker to elevate privileges in the context of the affected page. To exploit this vulnerability, the attacker must be logged in as a low-level administrator. The vulnerability is due to insufficient access control validation. An attacker could exploit this vulnerability by submitting a crafted URL request to gain privileged access in the context of the affected page. A successful exploit could allow the attacker to elevate privileges in the Webex Recording Admin page, which could allow them to view or delete recordings that they would not normally be able to access.

Weaknesses (CWE)

References

Scores

VersionScoreVectorScored by
CVSS 3.0MEDIUM 5.4CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:Ncisco
CVSS 3.1MEDIUM 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NNVD · nvd@nist.gov (Primary)
CVSS 3.0MEDIUM 5.4CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NNVD · psirt@cisco.com (Secondary)
CVSS 2.0MEDIUM 6.5AV:N/AC:L/Au:S/C:P/I:P/A:PNVD · nvd@nist.gov (Primary)

European references

Affected configurations (NVD CPE)

Affected products

ProductVersions
Cisco · Cisco Webex Meetingsaffected unspecified < n/a

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD