CVE-2018-15412

Опубликовано: 05 окт. 2018

Источник: nvd

CVSS3: 7.8

CVSS2: 9.3

EPSS Низкий

Описание

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

Ссылки

http://www.securityfocus.com/bid/105520
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1041795
Third Party Advisory
VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-webex-rce
Vendor Advisory
http://www.securityfocus.com/bid/105520
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1041795
Third Party Advisory
VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181003-webex-rce
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:cisco:webex_meetings_online:*:*:*:*:*:*:*:*

Версия до 1.3.37 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:cisco:webex_meetings_server:2.5:maintenance_release2_patch1:*:*:*:*:*:*

cpe:2.3:a:cisco:webex_meetings_server:2.5:maintenance_release5_patch1:*:*:*:*:*:*

cpe:2.3:a:cisco:webex_meetings_server:2.5:maintenance_release6_patch2:*:*:*:*:*:*

cpe:2.3:a:cisco:webex_meetings_server:2.5:maintenance_release6_patch3:*:*:*:*:*:*

cpe:2.3:a:cisco:webex_meetings_server:2.5:maintenance_release6_patch4:*:*:*:*:*:*

cpe:2.3:a:cisco:webex_meetings_server:2.5.1.29:*:*:*:*:*:*:*

cpe:2.3:a:cisco:webex_meetings_server:2.6:*:*:*:*:*:*:*

cpe:2.3:a:cisco:webex_meetings_server:2.6:maintenance_release1_patch1:*:*:*:*:*:*

cpe:2.3:a:cisco:webex_meetings_server:2.6:maintenance_release2_patch1:*:*:*:*:*:*

cpe:2.3:a:cisco:webex_meetings_server:2.6:maintenance_release3_patch1:*:*:*:*:*:*

cpe:2.3:a:cisco:webex_meetings_server:2.6:maintenance_release3_patch2:*:*:*:*:*:*

cpe:2.3:a:cisco:webex_meetings_server:2.7:*:*:*:*:*:*:*

cpe:2.3:a:cisco:webex_meetings_server:2.7:base:*:*:*:*:*:*

cpe:2.3:a:cisco:webex_meetings_server:2.7:maintenance_release1_patch1:*:*:*:*:*:*

cpe:2.3:a:cisco:webex_meetings_server:2.7:maintenance_release2_patch1:*:*:*:*:*:*

cpe:2.3:a:cisco:webex_meetings_server:2.7.1:*:*:*:*:*:*:*

cpe:2.3:a:cisco:webex_meetings_server:2.8:*:*:*:*:*:*:*

cpe:2.3:a:cisco:webex_meetings_server:2.8:base:*:*:*:*:*:*

Конфигурация 3

cpe:2.3:a:cisco:webex_business_suite_32:*:*:*:*:*:*:*:*

Версия до 32.15.20 (исключая)

Конфигурация 4

cpe:2.3:a:cisco:webex_business_suite_33:*:*:*:*:*:*:*:*

Версия до 33.3 (исключая)

EPSS

Процентиль: 45%

0.00224

Низкий

7.8 High

CVSS3

9.3 Critical

CVSS2

Дефекты

CWE-20

Связанные уязвимости

GHSA-jxwh-86w7-7jqj

CVSS3: 7.8

github

больше 3 лет назад

BDU:2018-01379

CVSS3: 7.8

fstec

больше 7 лет назад

Уязвимость проигрывателей Cisco Webex Network Recording Player и Cisco Webex Player для операционных систем Windows, связанная с недостаточной проверкой входных данных, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 45%

0.00224

Низкий

7.8 High

CVSS3

9.3 Critical

CVSS2

Дефекты

CWE-20