CVE-2018-0276

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability in Cisco WebEx Connect IM could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of an affected system. The vulnerability is due to insufficient input validation of some parameters that are passed to the web server of the affected system. An attacker could exploit this vulnerability by convincing a user to follow a malicious link or by intercepting a user request and injecting malicious code into the request. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected web interface or allow the attacker to access sensitive browser-based information. Cisco Bug IDs: CSCvi07812.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Apr 19, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-02778.6A vulnerability in the Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) certificate validation during EAP authenticatioCVE-2018-02786.5A vulnerability in the management console of Cisco Firepower System Software could allow an unauthenticated, remote attacker to access sensiCVE-2018-02798.8A vulnerability in the Secure Copy Protocol (SCP) server of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an authenticateCVE-2018-02807.5A vulnerability in the Real-Time Transport Protocol (RTP) bitstream processing of the Cisco Meeting Server could allow an unauthenticated, rCVE-2018-02815.8A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to restart an insCVE-2018-02826.8A vulnerability in the TCP socket code of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause an affectedCVE-2018-02835.8A vulnerability in the detection engine of Cisco Firepower System Software could allow an unauthenticated, remote attacker to restart an insCVE-2018-02846.5A vulnerability in the local status page functionality of the Cisco Meraki MR, MS, MX, Z1, and Z3 product lines could allow an authenticatedCVE-2018-02856.5A vulnerability in service logging for Cisco Prime Service Catalog could allow an authenticated, remote attacker to deny service to the userCVE-2018-02865.3A vulnerability in the netconf interface of Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a denial of serviCVE-2018-02878.8A vulnerability in the Cisco WebEx Network Recording Player for Advanced Recording Format (ARF) files could allow an unauthenticated, remoteCVE-2018-02885.3A vulnerability in Cisco WebEx Recording Format (WRF) Player could allow an unauthenticated, remote attacker to access sensitive data about