CVE-2018-0357

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability in the web framework of Cisco WebEx could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against the user of the web interface of an affected system. The vulnerability is due to insufficient input validation of certain parameters that are passed to the affected software via the HTTP GET and HTTP POST methods. An attacker who can convince a user to follow an attacker-supplied link could execute arbitrary script or HTML code in the user's browser in the context of an affected site. Cisco Bug IDs: CSCvi71274.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jun 7, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-03587.5A vulnerability in the file descriptor handling of Cisco TelePresence Video Communication Server (VCS) Expressway could allow an unauthentic CVE-2018-03595.5A vulnerability in the session identification management functionality of the web-based management interface for Cisco Meeting Server could CVE-2018-03605.5ClamAV before 0.100.1 has an HWP integer overflow with a resultant infinite loop via a crafted Hangul Word Processor file. This is in parseh CVE-2018-03613.3ClamAV before 0.100.1 lacks a PDF object length check, resulting in an unreasonably long time to parse a relatively small file.CVE-2018-03624.3A vulnerability in BIOS authentication management of Cisco 5000 Series Enterprise Network Compute System and Cisco Unified Computing (UCS) E CVE-2018-03638.8A vulnerability in the web-based management interface of Cisco Unified Communications Manager IM & Presence Service (formerly CUPS) could al CVE-2018-03648.8A vulnerability in the web-based management interface of Cisco Unified Communications Domain Manager could allow an unauthenticated, remote CVE-2018-03658.8A vulnerability in the web-based management interface of Cisco Firepower Management Center could allow an unauthenticated, remote attacker t CVE-2018-03666.1A vulnerability in the web-based management interface of Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker CVE-2018-03675.4A vulnerability in the web-based management interface of the Cisco Registered Envelope Service could allow an authenticated, remote attacker CVE-2018-03687.8A vulnerability in Cisco Digital Network Architecture (DNA) Center could allow an authenticated, local attacker to access sensitive informat CVE-2018-03698.6A vulnerability in the reassembly logic for fragmented IPv4 packets of Cisco StarOS running on virtual platforms could allow an unauthentica