Product: Cisco Webex Meetings
Summary
A vulnerability in the user profile component of Cisco Webex Meetings could have allowed an authenticated, remote attacker with low privileges to conduct a cross-site scripting (XSS) attack against a user of the web-based interface. This vulnerability existed due to insufficient validation of user-supplied input. An attacker could exploit this by persuading a user to click a crafted link, leading to a potential XSS attack.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2025-20328 |
Exploitation
To exploit this vulnerability, an attacker would need to convince a user of the Cisco Webex Meetings interface to click on a specially crafted link. This link would contain malicious code that, when executed, could allow the attacker to perform an XSS attack on the targeted user, potentially compromising their session or stealing sensitive information.
Affected Products
- Cisco Webex Meetings: Affected by the XSS vulnerability in the user profile component, allowing for potential exploitation through crafted links.
Mitigation
Cisco has addressed this vulnerability in the Cisco Webex Meetings service, and no customer action is needed. Users are advised to ensure they are using the latest version of the service to benefit from the security improvements.