CVE-2015-4208

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Cisco WebEx Meeting Center does not properly restrict the content of URLs in GET requests, which allows remote attackers to obtain sensitive information or conduct SQL injection attacks via vectors involving read access to a request, aka Bug ID CSCup88398.

Metrics

CVSS 2.0 7.5/10AV:N/AC:L/Au:N/C:P/I:P/A:P

Weakness enumeration

CWE-89 CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://tools.cisco.com/security/center/viewAlert.x?alertId=39458Vendor Advisory
http://www.securityfocus.com/bid/75361Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032705Third Party Advisory, VDB Entry
http://tools.cisco.com/security/center/viewAlert.x?alertId=39458Vendor Advisory
http://www.securityfocus.com/bid/75361Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1032705Third Party Advisory, VDB Entry

Timeline

Published: Jun 24, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-42096.4Cisco WebEx Meeting Center does not properly determine authorization for reading a host calendar, which allows remote attackers to obtain se CVE-2015-42104.3Cross-site scripting (XSS) vulnerability in Cisco WebEx Meeting Center allows remote attackers to inject arbitrary web script or HTML via a CVE-2015-42117.2Cisco AnyConnect Secure Mobility Client 3.1(60) on Windows does not properly validate pathnames, which allows local users to gain privileges CVE-2015-42125.0Cisco WebEx Meeting Center allows remote attackers to obtain sensitive information via unspecified vectors, as demonstrated by discovering c CVE-2015-42134.0Cisco NX-OS 1.1(1g) on Nexus 9000 devices allows remote authenticated users to discover cleartext passwords by leveraging the existence of a CVE-2015-42144.0Cisco Unified MeetingPlace 8.6(1.2) and 8.6(1.9) allows remote authenticated users to discover cleartext passwords by reading HTML source co CVE-2015-42156.1Cisco Wireless LAN Controller (WLC) devices with software 7.5(102.0) and 7.6(1.62) allow remote attackers to cause a denial of service (devi CVE-2015-42165.0The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management CVE-2015-42174.3The remote-support feature on Cisco Web Security Virtual Appliance (WSAv), Email Security Virtual Appliance (ESAv), and Security Management CVE-2015-42185.0The web-based user interface in Cisco Jabber through 9.6(3) and 9.7 through 9.7(5) on Windows allows remote attackers to obtain sensitive in CVE-2015-42194.0Cisco Secure Access Control System before 5.4(0.46.2) and 5.5 before 5.5(0.46) and Cisco Identity Services Engine 1.0(4.573) do not properly CVE-2015-42204.3Cross-site scripting (XSS) vulnerability in Cisco Unified Presence Server 9.1(1) allows remote attackers to inject arbitrary web script or H