Strix
26.1K

CVE-2017-6753

UnknownEPSS 5.95%

Last modified

CVE-2017-6753 is a vulnerability of currently unknown severity. A vulnerability in Cisco WebEx browser extensions for Google Chrome and Mozilla Firefox could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. This vulnerability affects the browser extensions for Cisco WebEx Meetings Server, Cisco WebEx Centers (Meeting Center, Event Center, Training Center, and Support Center), and Cisco WebEx Meetings when they are running on Microsoft Windows. EPSS estimates a 5.95% chance of exploitation in the next 30 days.

Description

A vulnerability in Cisco WebEx browser extensions for Google Chrome and Mozilla Firefox could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. This vulnerability affects the browser extensions for Cisco WebEx Meetings Server, Cisco WebEx Centers (Meeting Center, Event Center, Training Center, and Support Center), and Cisco WebEx Meetings when they are running on Microsoft Windows. The vulnerability is due to a design defect in the extension. An attacker who can convince an affected user to visit an attacker-controlled web page or follow an attacker-supplied link with an affected browser could exploit the vulnerability. If successful, the attacker could execute arbitrary code with the privileges of the affected browser. The following versions of the Cisco WebEx browser extensions are affected: Versions prior to 1.0.12 of the Cisco WebEx extension on Google Chrome, Versions prior to 1.0.12 of the Cisco WebEx extension on Mozilla Firefox. Cisco Bug IDs: CSCvf15012 CSCvf15020 CSCvf15030 CSCvf15033 CSCvf15036 CSCvf15037.

Metrics

EPSS Probability
5.95%

92.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
CiscoWebex Event Centert30_base
CiscoWebex Event Centert31_base
CiscoWebex Event Centert32_base
CiscoWebex Meeting Centert30_base
CiscoWebex Meeting Centert31_base
CiscoWebex Meeting Centert32_base
CiscoWebex Meetingst30_base
CiscoWebex Meetings Server1.1_base
CiscoWebex Meetings Server1.5.1.6
CiscoWebex Meetings Server1.5.1.131
CiscoWebex Meetings Server1.5_base
CiscoWebex Meetings Server2.0.1.107
CiscoWebex Meetings Server2.0_base
CiscoWebex Meetings Server2.5.1.5
CiscoWebex Meetings Server2.5.1.29
CiscoWebex Meetings Server2.5.99.2
CiscoWebex Meetings Server2.5_base
CiscoWebex Meetings Server2.6.0
CiscoWebex Meetings Server2.6.1.39
CiscoWebex Meetings Server2.7.1
CiscoWebex Meetings Server2.7_base
CiscoWebex Meetings Server2.8_base
CiscoWebex Meetings Server 2.0mr2
CiscoWebex Meetings Server 2.0mr3
CiscoWebex Meetings Server 2.0mr4
CiscoWebex Meetings Server 2.0mr5
CiscoWebex Meetings Server 2.0mr6
CiscoWebex Meetings Server 2.0mr7
CiscoWebex Meetings Server 2.0mr8
CiscoWebex Meetings Server 2.0mr9
CiscoWebex Meetings Server 2.0 Mr8 Patch1
CiscoWebex Meetings Server 2.0 Mr9 Patch1
CiscoWebex Meetings Server 2.0 Mr9 Patch2
CiscoWebex Meetings Server 2.0 Mr9 Patch3
CiscoWebex Meetings Server 2.5mr1
CiscoWebex Meetings Server 2.5mr2
CiscoWebex Meetings Server 2.5mr3
CiscoWebex Meetings Server 2.5mr4
CiscoWebex Meetings Server 2.5mr5
CiscoWebex Meetings Server 2.5mr6
CiscoWebex Meetings Server 2.5 Mr2 Patch1
CiscoWebex Meetings Server 2.5 Mr5 Patch1
CiscoWebex Meetings Server 2.5 Mr6 Patch1
CiscoWebex Meetings Server 2.5 Mr6 Patch2
CiscoWebex Meetings Server 2.5 Mr6 Patch3
CiscoWebex Meetings Server 2.5 Mr6 Patch4
CiscoWebex Meetings Server 2.6mr1
CiscoWebex Meetings Server 2.6mr2
CiscoWebex Meetings Server 2.6mr3
CiscoWebex Meetings Server 2.6 Mr1 Patch1

Showing 50 of 63 affected configurations. See NVD for the full list.

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2017-6753?
A vulnerability in Cisco WebEx browser extensions for Google Chrome and Mozilla Firefox could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. This vulnerability affects the browser extensions for Cisco WebEx Meetings Server, Cisco WebEx Centers (Meeting Center, Event Center, Training Center, and Support Center), and Cisco WebEx Meetings when they are running on Microsoft Windows. The vulnerability is due to a design defect in the extension. An attacker who can convince an affected user to visit an attacker-controlled web page or follow an attacker-supplied link with an affected browser could exploit the vulnerability. If successful, the attacker could execute arbitrary code with the privileges of the affected browser. The following versions of the Cisco WebEx browser extensions are affected: Versions prior to 1.0.12 of the Cisco WebEx extension on Google Chrome, Versions prior to 1.0.12 of the Cisco WebEx extension on Mozilla Firefox. Cisco Bug IDs: CSCvf15012 CSCvf15020 CSCvf15030 CSCvf15033 CSCvf15036 CSCvf15037.
How severe is CVE-2017-6753?
Severity scoring for CVE-2017-6753 is pending analysis. The EPSS model estimates a 5.95% probability of exploitation in the next 30 days.
How do I fix CVE-2017-6753?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-6753?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST