CVE-2014-3302

Published: Aug 1, 2014Modified: May 6, 2026

5.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitability: 8.6 / Impact: 4.9

Source: NVD

Description

user.php in Cisco WebEx Meetings Server 1.5(.1.131) and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708.

Affected (3)

Products: Cisco: Webex Meetings Server

Cisco

1 product

Webex Meetings Server

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Cisco Webex Meetings Server	Up to 1.5\(.1.131\)
Cisco Webex Meetings Server	Version 1.5
Cisco Webex Meetings Server	Version 1.5(.1.6)

Related CWEs

CWE-310

References (12)

http://secunia.com/advisories/58624

Source: psirt@cisco.com

http://tools.cisco.com/security/center/content/CiscoSecurityNotice/CVE-2014-3302

Source: psirt@cisco.com

Vendor Advisory

http://tools.cisco.com/security/center/viewAlert.x?alertId=35050

Source: psirt@cisco.com

Vendor Advisory

http://www.securityfocus.com/bid/68904

Source: psirt@cisco.com

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1030646

Source: psirt@cisco.com

Third Party AdvisoryVDB Entry

https://exchange.xforce.ibmcloud.com/vulnerabilities/94892

Source: psirt@cisco.com

http://secunia.com/advisories/58624