CVE-2017-12297

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

A vulnerability in Cisco WebEx Meeting Center could allow an authenticated, remote attacker to initiate connections to arbitrary hosts, aka a "URL Redirection Vulnerability." The vulnerability is due to insufficient access control for HTTP traffic directed to the Cisco WebEx Meeting Center. An attacker could exploit this vulnerability by sending a malicious URL to the Cisco WebEx Meeting Center. An exploit could allow the attacker to connect to arbitrary hosts. Cisco Bug IDs: CSCvf63843.

Metrics

CVSS 3.0 5.0/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
n/aCisco WebEx Meeting CenterCisco WebEx Meeting Center

References

Timeline

Published
Nov 30, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-122986.1A vulnerability in Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attackCVE-2017-122995.3A vulnerability exists in the process of creating default IP blocks during device initialization for Cisco ASA Next-Generation Firewall ServCVE-2017-12305.3IBM Tivoli Endpoint Manager (IBM BigFix Platform 9.2 and 9.5) uses insufficiently random numbers or values in a security context that dependCVE-2017-123005.8A vulnerability in the SNORT detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to bypass aCVE-2017-123016.7A vulnerability in the Python scripting subsystem of Cisco NX-OS Software could allow an authenticated, local attacker to escape the Python CVE-2017-123024.3A vulnerability in the Cisco Unified Communications Manager SQL database interface could allow an authenticated, remote attacker to impact tCVE-2017-123035.3A vulnerability in the Advanced Malware Protection (AMP) file filtering feature of Cisco AsyncOS Software for Cisco Web Security Appliance (CVE-2017-123046.1A vulnerability in the IOS daemon (IOSd) web-based management interface of Cisco IOS and IOS XE Software could allow an unauthenticated, remCVE-2017-123056.7A vulnerability in the debug interface of Cisco IP Phone 8800 series could allow an authenticated, local attacker to execute arbitrary commaCVE-2017-123064.4A vulnerability in the upgrade process of Cisco Spark Board could allow an authenticated, local attacker to install an unverified upgrade paCVE-2017-123076.1A vulnerability in the web framework of Cisco Small Business Managed Switches software could allow an unauthenticated, remote attacker to coCVE-2017-123086.1A vulnerability in the web framework of Cisco Small Business Managed Switches software could allow an unauthenticated, remote attacker to co
CVE-2017-12297: Medium severity, CVSS 5.0 | Vulnix