Security News > 2020 > January > Cisco Webex Vulnerability Exploited to Join Meetings Without a Password

Cisco on Friday informed customers that it has patched a vulnerability that allowed unauthorized users to join password-protected Webex meetings.

The vulnerability, tracked as CVE-2020-3142 and classified as high severity, affected Cisco Webex Meetings Suite sites and Cisco Webex Meetings Online sites, releases earlier than 39.11.5 and 40.1.3.

According to Cisco, the flaw allowed an unauthenticated attacker to join password-protected meetings without the need to provide a password.

"The vulnerability is due to unintended meeting information exposure in a specific meeting join flow for mobile applications. An unauthorized attendee could exploit this vulnerability by accessing a known meeting ID or meeting URL from the mobile device's web browser. The browser will then request to launch the device's Webex mobile application," Cisco said in its advisory.

Cisco told SecurityWeek that some of its customers had used the vulnerability to access their own meetings, and the company is also aware of "Exploitation of the vulnerability by unauthenticated attendees using the mobile app to gain unauthorized access to Webex's audio capability."

News URL

http://feedproxy.google.com/~r/Securityweek/~3/jUqFxU3oR1g/cisco-webex-vulnerability-exploited-join-meetings-without-password