Attacker Value
Unknown
(0 users assessed)
Exploitability
Unknown
(0 users assessed)
User Interaction
Required
Privileges Required
None
Attack Vector
Network
0

CVE-2017-3823

Disclosure Date: February 01, 2017 •
CVE-2017-3823 CVSS v3 Base Score: 8.8
Exploited in the Wild
Reported by AttackerKB Worker
View Source Details
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on Mozilla Firefox, the GpcContainer Class ActiveX control plugin before 10031.6.2017.0126 on Internet Explorer, and the Download Manager ActiveX control plugin before 2.1.0.10 on Internet Explorer. A vulnerability in these Cisco WebEx browser extensions could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. This vulnerability affects the browser extensions for Cisco WebEx Meetings Server and Cisco WebEx Centers (Meeting Center, Event Center, Training Center, and Support Center) when they are running on Microsoft Windows. The vulnerability is a design defect in an application programing interface (API) response parser within the extension. An attacker that can convince an affected user to visit an attacker-controlled web page or follow an attacker-supplied link with an affected browser could exploit the vulnerability. If successful, the attacker could execute arbitrary code with the privileges of the affected browser.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics
Base Score:
8.8 High
Impact Score:
5.9
Exploitability Score:
2.8
Vector:
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
Required
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Offensive Application
Unknown
Utility Class
Unknown
Ports
Unknown
OS
Unknown
Vulnerable Versions
Cisco WebEx browser extensions
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
exploit/windows/browser/cisco_webex_ext
Reporter
Unknown

Vendors

  • cisco

Products

  • activetouch general plugin container 105,
  • download manager 2.1.0.9,
  • gpccontainer class,
  • webex,
  • webex meeting center 2.6 base,
  • webex meeting center 2.6 mr1,
  • webex meeting center 2.6 mr2,
  • webex meeting center 2.6 mr3,
  • webex meeting center 2.7 base,
  • webex meeting center 2.7 mr1,
  • webex meeting center 2.7 mr2,
  • webex meeting center t29 base,
  • webex meeting center t30 base,
  • webex meeting center t31 base,
  • webex meetings server 2.0 base,
  • webex meetings server 2.0 mr2,
  • webex meetings server 2.0 mr3,
  • webex meetings server 2.0 mr4,
  • webex meetings server 2.0 mr5,
  • webex meetings server 2.0 mr6,
  • webex meetings server 2.0 mr7,
  • webex meetings server 2.0 mr8,
  • webex meetings server 2.0 mr9,
  • webex meetings server 2.5 base,
  • webex meetings server 2.5 mr1,
  • webex meetings server 2.5 mr2,
  • webex meetings server 2.5 mr3,
  • webex meetings server 2.5 mr4,
  • webex meetings server 2.5 mr5,
  • webex meetings server 2.5 mr6,
  • webex meetings server 2.6 base,
  • webex meetings server 2.6 mr1,
  • webex meetings server 2.6 mr2,
  • webex meetings server 2.6 mr3,
  • webex meetings server 2.7 base,
  • webex meetings server 2.7 mr1,
  • webex meetings server 2.7 mr2

Exploited in the Wild

Reported by:
Technical Analysis