Cisco WebEx Centers Username Enumeration Information Disclosure Vulnerability
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
A vulnerability in web interface of the Cisco Webex Event Center, Cisco Webex Meeting Center, Cisco Webex Support Center, and Cisco Webex Training Center could allow an unauthenticated, remote attacker to guess account usernames. The vulnerability is due to missing CAPTCHA protection in certain URLs. An attacker could exploit this vulnerability by sending a crafted request to the web interface. A successful exploit could allow the attacker to know if a given username is valid and find the real name of the user.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Cisco | Cisco WebEx Event Center | all versions | — | No fix listed | CNA |
- Cisco WebEx Event Center VendorCisco Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:webex_meetings_online:11.0.0:*:*:*:*:*:*:* | 11.0.0 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:webex_meetings_server:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Cisco |
| cpe:2.3:a:cisco:webex_event_center:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Cisco |
| cpe:2.3:a:cisco:webex_meeting_center:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Cisco |
| cpe:2.3:a:cisco:webex_support_center:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Cisco |
| cpe:2.3:a:cisco:webex_training_center:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Cisco |
- cpe:2.3:a:cisco:webex_meetings_online:11.0.0:*:*:*:*:*:*:* Versions 11.0.0 Vulnerable ·Cisco
- cpe:2.3:a:cisco:webex_meetings_server:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Cisco
- cpe:2.3:a:cisco:webex_event_center:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
- cpe:2.3:a:cisco:webex_meeting_center:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
- cpe:2.3:a:cisco:webex_support_center:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
- cpe:2.3:a:cisco:webex_training_center:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-15987
- 2026-10-03 Alias added: GHSA-99jc-7925-7fc9
References
More Cisco Webex Event Center vulnerabilities
- TI-2017-04508 Memory corruption in Cisco WebEx Browser Extension CVSS 3.0HIGH 8.8
- TI-2014-01742 meetinginfo.do in Cisco WebEx Event Center, WebEx Meeting Center, WebEx Sales Center… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2019-15987 · CVE Program
- CVE-2019-15987 · NVD
- FIRST EPSS
- GHSA-99jc-7925-7fc9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences