CVE-2018-0436: cisco cisco webex teams Improper Access Control
Vulnerability summary
CVE-2018-0436 is a high (CVSS 8.7) Improper Access Control vulnerability in cisco cisco webex teams. EPSS estimates a 1.28% chance of exploitation in the next 30 days, higher than 69.6% of scored vulnerabilities.
Timeline
- 05-10-2018PublishedVulnerability first disclosed.
- 26-11-2024Last modifiedVulnerability information updated.
Description
A vulnerability in Cisco Webex Teams, formerly Cisco Spark, could allow an authenticated, remote attacker to view and modify data for an organization other than their own organization. The vulnerability exists because the affected software performs insufficient checks for associations between user accounts and organization accounts. An attacker who has administrator or compliance officer privileges for one organization account could exploit this vulnerability by using those privileges to view and modify data for another organization account. No customer data was impacted by this vulnerability.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
1.28%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
0.00 pp
From 1.28% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected systems
Cisco2 products
- cisco webex teamsn/a
- webex_teams< 10.6.0
1 vendor · 2 products
References
2 links- tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-webex-id-modVendor AdvisoryX Refsource CISCO