CVE-2018-0439

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A vulnerability in the web-based management interface of Cisco Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a customized link. A successful exploit could allow the attacker to perform arbitrary actions on an affected device by using a web browser and with the privileges of the user.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

Vendor	Product	Versions
Cisco	Cisco Meeting Server	n/a

References

http://www.securityfocus.com/bid/105287Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041680Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-meeting-csrfVendor Advisory
http://www.securityfocus.com/bid/105287Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041680Third Party Advisory, VDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-meeting-csrfVendor Advisory

Timeline

Published: Oct 5, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-04407.2A vulnerability in the web interface of Cisco Data Center Network Manager could allow an authenticated application administrator to execute CVE-2018-04417.4A vulnerability in the 802.11r Fast Transition feature set of Cisco IOS Access Points (APs) Software could allow an unauthenticated, adjacen CVE-2018-04427.5A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol component of Cisco Wireless LAN Controller (WLC)CVE-2018-04437.5A vulnerability in the Control and Provisioning of Wireless Access Points (CAPWAP) protocol component of Cisco Wireless LAN Controller (WLC)CVE-2018-04446.1A vulnerability in the web-based management interface of Cisco Packaged Contact Center Enterprise could allow an unauthenticated, remote att CVE-2018-04458.8A vulnerability in the web-based management interface of Cisco Packaged Contact Center Enterprise could allow an unauthenticated, remote att CVE-2018-04468.8A vulnerability in the web-based management interface of Cisco Industrial Network Director could allow an unauthenticated, remote attacker t CVE-2018-04475.3A vulnerability in the anti-spam protection mechanisms of Cisco AsyncOS Software for the Cisco Email Security Appliance (ESA) could allow an CVE-2018-04489.8A vulnerability in the identity management service of Cisco Digital Network Architecture (DNA) Center could allow an unauthenticated, remote CVE-2018-04494.2A vulnerability in the Cisco Jabber Client Framework (JCF) software, installed as part of the Cisco Jabber for Mac client, could allow an au CVE-2018-04506.1A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker t CVE-2018-04518.8A vulnerability in the web-based management interface of Cisco Tetration Analytics could allow an authenticated, remote attacker to conduct