Read the docs
TI-2017-04410 Aliases CVE-2017-6651GHSA-7mmm-cmfg-5466

Information disclosure in Cisco WebEx Meetings Server

Priority LOW 37CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

A vulnerability in Cisco WebEx Meetings Server could allow unauthenticated, remote attackers to gain information that could allow them to access scheduled customer meetings. The vulnerability is due to an incomplete configuration of the robots.txt file on customer-hosted WebEx solutions and occurs when the Short URL functionality is not activated. All releases of Cisco WebEx Meetings Server later than release 2.5MR4 provide this functionality. An attacker could exploit this vulnerability via an exposed parameter to search for indexed meeting information. A successful exploit could allow the attacker to obtain scheduled meeting information and potentially allow the attacker to attend scheduled, customer meetings. This vulnerability affects the following releases of Cisco WebEx Meetings Server: 2.5, 2.6, 2.7, 2.8. Cisco Bug IDs: CSCve25950.

Why it matters now

EPSS 0.02021 81st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—Cisco WebEx Meetings ServerCisco WebEx Meetings Server—No fix listedCNA
  • Cisco WebEx Meetings Server Vendor— Affected Cisco WebEx Meetings Server Fixed in — No fix listed CNA

CPE configurations NVD · 32

CPEVersionsRoleVendor
cpe:2.3:a:cisco:webex_meetings_server:2.5.1.5:*:*:*:*:*:*:*2.5.1.5VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.5.1.29:*:*:*:*:*:*:*2.5.1.29VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.5.99.2:*:*:*:*:*:*:*2.5.99.2VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.5_base:*:*:*:*:*:*:*2.5_baseVulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.5_mr1:*:*:*:*:*:*:*2.5_mr1VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.5_mr2:*:*:*:*:*:*:*2.5_mr2VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.5_mr2:patch1:*:*:*:*:*:*2.5_mr2 patch1VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.5_mr3:*:*:*:*:*:*:*2.5_mr3VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.5_mr4:*:*:*:*:*:*:*2.5_mr4VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.5_mr5:*:*:*:*:*:*:*2.5_mr5VulnerableCisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.5.1.5:*:*:*:*:*:*:* Versions 2.5.1.5 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.5.1.29:*:*:*:*:*:*:* Versions 2.5.1.29 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.5.99.2:*:*:*:*:*:*:* Versions 2.5.99.2 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.5_base:*:*:*:*:*:*:* Versions 2.5_base Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.5_mr1:*:*:*:*:*:*:* Versions 2.5_mr1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.5_mr2:*:*:*:*:*:*:* Versions 2.5_mr2 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.5_mr2:patch1:*:*:*:*:*:* Versions 2.5_mr2 patch1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.5_mr3:*:*:*:*:*:*:* Versions 2.5_mr3 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.5_mr4:*:*:*:*:*:*:* Versions 2.5_mr4 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.5_mr5:*:*:*:*:*:*:* Versions 2.5_mr5 Vulnerable ·Cisco
Show 22 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:cisco:webex_meetings_server:2.5_mr5:patch1:*:*:*:*:*:*2.5_mr5 patch1VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.5_mr6:*:*:*:*:*:*:*2.5_mr6VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.5_mr6:patch_1:*:*:*:*:*:*2.5_mr6 patch_1VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.5_mr6:patch2:*:*:*:*:*:*2.5_mr6 patch2VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.5_mr6:patch3:*:*:*:*:*:*2.5_mr6 patch3VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.5_mr6:patch4:*:*:*:*:*:*2.5_mr6 patch4VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.6.0:*:*:*:*:*:*:*2.6.0VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.6.1.39:*:*:*:*:*:*:*2.6.1.39VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.6_mr1:*:*:*:*:*:*:*2.6_mr1VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.6_mr1:patch1:*:*:*:*:*:*2.6_mr1 patch1VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.6_mr2:*:*:*:*:*:*:*2.6_mr2VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.6_mr2:patch1:*:*:*:*:*:*2.6_mr2 patch1VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.6_mr3:*:*:*:*:*:*:*2.6_mr3VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.6_mr3:patch1:*:*:*:*:*:*2.6_mr3 patch1VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.6_mr3:patch2:*:*:*:*:*:*2.6_mr3 patch2VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.7.1:*:*:*:*:*:*:*2.7.1VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.7_base:*:*:*:*:*:*:*2.7_baseVulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.7_mr1:*:*:*:*:*:*:*2.7_mr1VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.7_mr1:patch1:*:*:*:*:*:*2.7_mr1 patch1VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.7_mr2:*:*:*:*:*:*:*2.7_mr2VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.7_mr2:patch1:*:*:*:*:*:*2.7_mr2 patch1VulnerableCisco
cpe:2.3:a:cisco:webex_meetings_server:2.8_base:*:*:*:*:*:*:*2.8_baseVulnerableCisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.5_mr5:patch1:*:*:*:*:*:* Versions 2.5_mr5 patch1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.5_mr6:*:*:*:*:*:*:* Versions 2.5_mr6 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.5_mr6:patch_1:*:*:*:*:*:* Versions 2.5_mr6 patch_1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.5_mr6:patch2:*:*:*:*:*:* Versions 2.5_mr6 patch2 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.5_mr6:patch3:*:*:*:*:*:* Versions 2.5_mr6 patch3 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.5_mr6:patch4:*:*:*:*:*:* Versions 2.5_mr6 patch4 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.6.0:*:*:*:*:*:*:* Versions 2.6.0 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.6.1.39:*:*:*:*:*:*:* Versions 2.6.1.39 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.6_mr1:*:*:*:*:*:*:* Versions 2.6_mr1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.6_mr1:patch1:*:*:*:*:*:* Versions 2.6_mr1 patch1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.6_mr2:*:*:*:*:*:*:* Versions 2.6_mr2 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.6_mr2:patch1:*:*:*:*:*:* Versions 2.6_mr2 patch1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.6_mr3:*:*:*:*:*:*:* Versions 2.6_mr3 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.6_mr3:patch1:*:*:*:*:*:* Versions 2.6_mr3 patch1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.6_mr3:patch2:*:*:*:*:*:* Versions 2.6_mr3 patch2 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.7.1:*:*:*:*:*:*:* Versions 2.7.1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.7_base:*:*:*:*:*:*:* Versions 2.7_base Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.7_mr1:*:*:*:*:*:*:* Versions 2.7_mr1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.7_mr1:patch1:*:*:*:*:*:* Versions 2.7_mr1 patch1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.7_mr2:*:*:*:*:*:*:* Versions 2.7_mr2 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.7_mr2:patch1:*:*:*:*:*:* Versions 2.7_mr2 patch1 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:webex_meetings_server:2.8_base:*:*:*:*:*:*:* Versions 2.8_base Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-6651
  2. 2026-10-03 Alias added: GHSA-7mmm-cmfg-5466

References

Advisory 1

  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
  • TI-2017-02920 Memory corruption in Cisco WebEx browser extensions CVSS 3.0HIGH 8.8
  • TI-2018-00079 Improper input validation in Cisco WebEx Advanced Recording Format Player CVSS 3.0CRITICAL 9.6
  • TI-2020-02913 Cisco Webex Meetings and Cisco Webex Meetings Server Token Handling Unauthorized Access Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2017-09144 Memory corruption in Cisco WebEx Recording Format and Advanced Recording Format Players CVSS 3.0CRITICAL 9.6
  • TI-2017-09140 Memory corruption in Cisco WebEx Recording Format and Advanced Recording Format Players CVSS 3.0CRITICAL 9.6
See all 135 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences