Webex Vulnerability Information

[regina.gaines]

Our company received a Cybersecurity Advisory for multiple vulnerabilities in Cisco products. For WebEx, it stated: A vulnerability in the web-based interface of Cisco Webex Meetings could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. . Also, it states that updates should be available to resolve this issue. Is this as simple as downloading the latest version and updating on devices, or are there minor updates that need to be downloaded and installed?

[dtibbe · Accepted solution]

It does not state anything for WebEx, only for Webex...

I guess you're referring to this advisory, aren't you? https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-webex-xss-FmbPu2pe.html

It states that the issue wass in the cloud-based service and is already resolved. No user interaction or client side tasks are required.

[dtibbe · Accepted solution]

It does not state anything for WebEx, only for Webex...

I guess you're referring to this advisory, aren't you? https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-webex-xss-FmbPu2pe.html

It states that the issue wass in the cloud-based service and is already resolved. No user interaction or client side tasks are required.

[regina.gaines]

Thank you for the response. Yes, that's it. The information below in the bulletin raised a flag for us ("Cicso Webex Meetings"). We considered a need to update the WebEx Meeting client. 

SYSTEMS AFFECTED:

• Cisco RCM for StarOS releases prior to 21.25.4

• Cisco Webex Meetings

• Vulnerable releases of ConfD.

• Cisco Ultra Gateway Platform
• Cisco Enterprise NFV Infrastructure Software (NFVIS)

Cisco Network Services Orchestrator (NSO

[Stephanie Knoop · Accepted solution]

For Webex Meetings, the vulnerability was a server side issue.  However, the client should be auto-updated on a monthly cycle unless your organization has opted for the slow release program. You should have no worries otherwise.