Privilege escalation in Cisco Webex Teams
CVE-2018-0436
A vulnerability in Cisco Webex Teams, formerly Cisco Spark, could allow an authenticated, remote attacker to view and modify data for an organization other than their own organization. The vulnerability exists because the affected software performs insufficient checks for associations between user accounts and organization accounts. An attacker who has administrator or compliance officer privileges for one organization account could exploit this vulnerability by using those privileges to view and modify data for another organization account. No customer data was impacted by this vulnerability.
EPSS: 0.013 (68.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.7 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N.
Affected products
- Cisco Webex Teams — versions n/a
- Cisco Webex_teams
Weakness classification (CWE)
References
- psirt@cisco.com (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
- psirt@cisco.com (x_refsource_CISCO, vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2018-0436?
- CVE-2018-0436 is a high-severity vulnerability in Cisco Webex Teams, classified under Improper Access Control. CVSS score: 8.7/10. Published 2018-10-05.
- How severe is CVE-2018-0436?
- High severity. CVSS v3 base score is 8.7 out of 10.