Product: Cisco Webex Meetings
Summary
A vulnerability in the user profile component of Cisco Webex Meetings could have allowed an authenticated, remote attacker with low privileges to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. This vulnerability existed due to insufficient validation of user-supplied input. An attacker could exploit this by persuading a user to click a crafted link, leading to an XSS attack.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2025-20328 |
Exploitation
To exploit this vulnerability, an attacker would need to convince a user of the Cisco Webex Meetings interface to click on a specially crafted link. Once the user clicks the link, the attacker could execute a cross-site scripting attack, potentially allowing them to manipulate the user’s session or steal sensitive information.
Affected Products
- Cisco Webex Meetings: Vulnerable due to insufficient input validation in the user profile component, allowing for potential XSS attacks.
Mitigation
Cisco has addressed this vulnerability in the Cisco Webex Meetings service, and no customer action is needed. Users are encouraged to ensure they are using the latest version of the service to benefit from the security improvements.