54%
27%
41%
A vulnerability in the reclaim host role feature of Cisco Webex Meetings and Cisco Webex Meetings Server could allow an authenticated, remote attacker to take over the host role during a meeting. This vulnerability is due to a lack of protection against brute forcing of the host key. An attacker could exploit this vulnerability by sending crafted requests to a vulnerable Cisco Webex Meetings or Webex Meetings Server site. A successful exploit would require the attacker to have access to join a Webex meeting, including applicable meeting join links and passwords. A successful exploit could allow the attacker to acquire or take over the host role for a meeting.
CVSS 3.1 Base Score 5.4. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L).
CVSS 2.0 Base Score 5.5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:S/C:N/I:P/A:P).
The following code, extracted from a servlet's doPost() method, performs an authentication lookup every time the servlet is invoked.
int authResult = authenticateUser(username, password);However, the software makes no attempt to restrict excessive authentication attempts.
This code attempts to limit the number of login attempts by causing the process to sleep before completing the authentication.
$isAuthenticated = authenticateUser($username, $password);However, there is no limit on parallel connections, so this does not increase the amount of time an attacker needs to complete an attack.
In the following C/C++ example the validateUser method opens a socket connection, reads a username and password from the socket and attempts to authenticate the username and password.
}
return(SUCCESS);return(FAIL);
}}isValidUser = AuthenticateUser(username, password);The validateUser method will continuously check for a valid username and password without any restriction on the number of authentication attempts made. The method should limit the number of authentication attempts made to prevent brute force attacks as in the following example code.
}
}
count++;}isValidUser = AuthenticateUser(username, password);return(SUCCESS);return(FAIL);ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.
If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.