Strix
26.1K

CVE-2017-6651

UnknownEPSS 2.02%

Last modified

CVE-2017-6651 is a vulnerability of currently unknown severity. A vulnerability in Cisco WebEx Meetings Server could allow unauthenticated, remote attackers to gain information that could allow them to access scheduled customer meetings. The vulnerability is due to an incomplete configuration of the robots.txt file on customer-hosted WebEx solutions and occurs when the Short URL functionality is not activated. EPSS estimates a 2.02% chance of exploitation in the next 30 days.

Description

A vulnerability in Cisco WebEx Meetings Server could allow unauthenticated, remote attackers to gain information that could allow them to access scheduled customer meetings. The vulnerability is due to an incomplete configuration of the robots.txt file on customer-hosted WebEx solutions and occurs when the Short URL functionality is not activated. All releases of Cisco WebEx Meetings Server later than release 2.5MR4 provide this functionality. An attacker could exploit this vulnerability via an exposed parameter to search for indexed meeting information. A successful exploit could allow the attacker to obtain scheduled meeting information and potentially allow the attacker to attend scheduled, customer meetings. This vulnerability affects the following releases of Cisco WebEx Meetings Server: 2.5, 2.6, 2.7, 2.8. Cisco Bug IDs: CSCve25950.

Metrics

EPSS Probability
2.02%

78.4th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
CiscoWebex Meetings Server2.5.1.5
CiscoWebex Meetings Server2.5.1.29
CiscoWebex Meetings Server2.5.99.2
CiscoWebex Meetings Server2.5_base
CiscoWebex Meetings Server2.5_mr1
CiscoWebex Meetings Server2.5_mr2
CiscoWebex Meetings Server2.5_mr3
CiscoWebex Meetings Server2.5_mr4
CiscoWebex Meetings Server2.5_mr5
CiscoWebex Meetings Server2.5_mr6
CiscoWebex Meetings Server2.6.0
CiscoWebex Meetings Server2.6.1.39
CiscoWebex Meetings Server2.6_mr1
CiscoWebex Meetings Server2.6_mr2
CiscoWebex Meetings Server2.6_mr3
CiscoWebex Meetings Server2.7.1
CiscoWebex Meetings Server2.7_base
CiscoWebex Meetings Server2.7_mr1
CiscoWebex Meetings Server2.7_mr2
CiscoWebex Meetings Server2.8_base

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2017-6651?
A vulnerability in Cisco WebEx Meetings Server could allow unauthenticated, remote attackers to gain information that could allow them to access scheduled customer meetings. The vulnerability is due to an incomplete configuration of the robots.txt file on customer-hosted WebEx solutions and occurs when the Short URL functionality is not activated. All releases of Cisco WebEx Meetings Server later than release 2.5MR4 provide this functionality. An attacker could exploit this vulnerability via an exposed parameter to search for indexed meeting information. A successful exploit could allow the attacker to obtain scheduled meeting information and potentially allow the attacker to attend scheduled, customer meetings. This vulnerability affects the following releases of Cisco WebEx Meetings Server: 2.5, 2.6, 2.7, 2.8. Cisco Bug IDs: CSCve25950.
How severe is CVE-2017-6651?
Severity scoring for CVE-2017-6651 is pending analysis. The EPSS model estimates a 2.02% probability of exploitation in the next 30 days.
How do I fix CVE-2017-6651?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2017

View all 2017CVEs →

Are you affected by CVE-2017-6651?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST