Read the docs
TI-2019-01303 Aliases CVE-2019-1677GHSA-jpxp-w99g-6pgv

Cisco Webex Meetings for Android Cross-Site Scripting Vulnerability

Priority LOW 21CWE-79Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

A vulnerability in Cisco Webex Meetings for Android could allow an unauthenticated, local attacker to perform a cross-site scripting attack against the application. The vulnerability is due to insufficient validation of the application input parameters. An attacker could exploit this vulnerability by sending a malicious request to the Webex Meetings application through an intent. A successful exploit could allow the attacker to execute script code in the context of the Webex Meetings application. Versions prior to 11.7.0.236 are affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00392 33rd percentileScored 2026-11-07
Fix Fixed Cisco WebEx Meetings for Android (Cisco): 11.7.0.236

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco WebEx Meetings for Androidbefore 11.7.0.23611.7.0.236Patch availableCNA
  • Cisco WebEx Meetings for Android VendorCisco Affected before 11.7.0.236 Fixed in 11.7.0.236 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:cisco:webex_meetings:*:*:*:*:*:android:*:*before 11.7.0.236VulnerableCisco
  • cpe:2.3:a:cisco:webex_meetings:*:*:*:*:*:android:*:* Versions before 11.7.0.236 Vulnerable ·Cisco

Remediation

  • Fix · CNA Cisco WebEx Meetings for Android (Cisco) Fixed in 11.7.0.236

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-1677
  2. 2026-10-03 Alias added: GHSA-jpxp-w99g-6pgv

References

Advisory 1

  • TI-2019-01300 Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools Update Service Command Injection Vulnerability CVSS 3.0HIGH 8.8
  • TI-2018-00079 Improper input validation in Cisco WebEx Advanced Recording Format Player CVSS 3.0CRITICAL 9.6
  • TI-2018-00224 Improper input validation in Cisco WebEx Advanced Recording Format file players CVSS 3.0CRITICAL 9.6
  • TI-2020-02913 Cisco Webex Meetings and Cisco Webex Meetings Server Token Handling Unauthorized Access Vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2020-02894 Cisco Webex Meetings Desktop App for Mac Update Feature Code Execution Vulnerability CVSS 3.1HIGH 8.8
  • TI-2017-09144 Memory corruption in Cisco WebEx Recording Format and Advanced Recording Format Players CVSS 3.0CRITICAL 9.6
See all 68 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences