1. CVE-Search
  2. CVE-2014-0691
ID CVE-2014-0691
Summary Cisco WebEx Meetings Server before 1.1 uses meeting IDs with insufficient entropy, which makes it easier for remote attackers to bypass authentication and join arbitrary meetings without a password, aka Bug ID CSCuc79643.
References
Vulnerable Configurations
  • cpe:2.3:a:cisco:webex_meetings_server:-:*:*:*:*:*:*:*
    cpe:2.3:a:cisco:webex_meetings_server:-:*:*:*:*:*:*:*
  • cpe:2.3:a:cisco:webex_meetings_server:1.0:*:*:*:*:*:*:*
    cpe:2.3:a:cisco:webex_meetings_server:1.0:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 14-11-2017 - 18:38)
Impact:
Exploitability:
CWE CWE-331
CAPEC
  • Session Credential Falsification through Prediction
    This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:N/A:N
refmap via4
confirm https://www.cisco.com/c/en/us/td/docs/collaboration/CWMS/1_1/b_Release_Notes.html
Last major update 14-11-2017 - 18:38
Published 24-10-2017 - 14:29
Last modified 14-11-2017 - 18:38
Back to Top