What’s Vulnerable › Vulnerabilities

CVE-2020-3361: Cisco Webex Meetings and Cisco Webex Meetings Server Token Handling Unauthorized Access Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-06-18 · updated 2026-06-17
• Weakness: CWE-287

Description

A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to gain unauthorized access to a vulnerable Webex site. The vulnerability is due to improper handling of authentication tokens by a vulnerable Webex site. An attacker could exploit this vulnerability by sending crafted requests to a vulnerable Cisco Webex Meetings or Cisco Webex Meetings Server site. If successful, the attacker could gain the privileges of another user within the affected Webex site.

Affected products

• Cisco Webex Meetings: through 39.5.25; from 40.1.0 through 40.4.10; 40.6.0
• Cisco WebEx Meetings Server: before 4.0; 4.0, 4.0-maintenance_release1, 4.0-maintenance_release2, 4.0-maintenance_release3 — fixed in 4.0

How to fix

Upgrade to a fixed version: Cisco WebEx Meetings Server 4.0. Check the vendor advisory for mitigations.

References

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-token-zPvEjKN
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-token-zPvEjKN

Get alerted when CVE-2020-3361 or the next vulnerability affects your stack