CVE-2019-15987 - Cisco WebEx Centers Username Enumeration Information Disclosure Vulnerability

Back Back to CVE browser

MEDIUM

Cisco WebEx Centers Username Enumeration Information Disclosure Vulnerability

Published Nov 26, 2019

5.3

MEDIUM

CVSS 3.1

EPSS 1.58%

Description

A vulnerability in web interface of the Cisco Webex Event Center, Cisco Webex Meeting Center, Cisco Webex Support Center, and Cisco Webex Training Center could allow an unauthenticated, remote attacker to guess account usernames. The vulnerability is due to missing CAPTCHA protection in certain URLs. An attacker could exploit this vulnerability by sending a crafted request to the web interface. A successful exploit could allow the attacker to know if a given username is valid and find the real name of the user.

Affected products

Vendor Cisco Product Cisco WebEx Event Center Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cisco

Cisco WebEx Event Center

n/a

Version	Status	Constraints
unspecified	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (1)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-webex-centers-infodis
vendor-advisoryx_refsource_CISCOVendor Advisory

Link	Providers	Tags
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20191120-webex-centers-infodis		vendor-advisoryx_refsource_CISCOVendor Advisory