CVE-2018-0436 (CNNVD-201809-256)
中文标题:
Cisco Webex Teams 访问控制错误漏洞
英文标题:
Cisco Webex Teams Information Disclosure and Modification Vulnerability
漏洞描述
中文描述:
Cisco Webex Teams是美国思科（Cisco）公司的一款团队协作应用程序。该程序包括视频会议、消息群发和文件共享等功能。 Cisco Webex Teams 20180417-150803之前版本中存在访问控制错误漏洞，该漏洞源于软件对用户账户和组织账户之间的关联检查不充分。远程攻击者可利用该漏洞查看并修改其他组织的数据。
英文描述:
A vulnerability in Cisco Webex Teams, formerly Cisco Spark, could allow an authenticated, remote attacker to view and modify data for an organization other than their own organization. The vulnerability exists because the affected software performs insufficient checks for associations between user accounts and organization accounts. An attacker who has administrator or compliance officer privileges for one organization account could exploit this vulnerability by using those privileges to view and modify data for another organization account. No customer data was impacted by this vulnerability.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| Cisco | Cisco Webex Teams | n/a | - | - |
cpe:2.3:a:cisco:cisco_webex_teams:n_a:*:*:*:*:*:*:*
|
| cisco | webex_teams | * | - | - |
cpe:2.3:a:cisco:webex_teams:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
CVSS评分详情
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2018-0436 |
2025-11-11 15:19:35 | 2025-11-11 07:34:57 |
| NVD | nvd_CVE-2018-0436 |
2025-11-11 14:55:59 | 2025-11-11 07:43:33 |
| CNNVD | cnnvd_CNNVD-201809-256 |
2025-11-11 15:10:04 | 2025-11-11 07:53:56 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 授权问题
- cnnvd_id: 未提取 -> CNNVD-201809-256
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- severity: SeverityLevel.MEDIUM -> SeverityLevel.HIGH
- cvss_score: 未提取 -> 8.7
- cvss_vector: NOT_EXTRACTED -> CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
- cvss_version: NOT_EXTRACTED -> 3.1
- affected_products_count: 1 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']