Vulnerability · Published Aug 17, 2020 · Assigned by cisco
CVE-2020-3412Cisco Webex Meetings Scheduled Meeting Template Creation Vulnerability
Medium 4.3
In plain English
A medium-severity improper access control in Cisco Webex Meetings from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 54% of all known vulnerabilities).
Official description
A vulnerability in the scheduled meeting template feature of Cisco Webex Meetings could allow an authenticated, remote attacker to create a scheduled meeting template that would belong to another user in their organization. The vulnerability is due to insufficient authorization enforcement for the creation of scheduled meeting templates. An attacker could exploit this vulnerability by sending a crafted request to the Webex Meetings interface to create a scheduled meeting template. A successful exploit could allow the attacker to create a scheduled meeting template that would belong to a user other than themselves.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Webex Meetings | n/a |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References
- 20200805 Cisco Webex Meetings Scheduled Meeting Template Creation Vulnerability vendor-advisory, x_refsource_CISCO