What’s Vulnerable › Vulnerabilities

CVE-2020-3472: Cisco Webex Meetings User Email Address Information Disclosure Vulnerability

• Severity: medium (CVSS 5.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-08-17 · updated 2026-06-17
• Weakness: CWE-200

Description

A vulnerability in the contacts feature of Cisco Webex Meetings could allow an authenticated, remote attacker with a legitimate user account to access sensitive information. The vulnerability is due to improper access restrictions on users who are added within user contacts. An attacker on one Webex Meetings site could exploit this vulnerability by sending specially crafted requests to the Webex Meetings site. A successful exploit could allow the attacker to view the details of users on another Webex site, including user names and email addresses.

Affected products

• Cisco WebEx WRF Player: before 40.7.0 — fixed in 40.7.0

How to fix

Upgrade to a fixed version: Cisco WebEx WRF Player 40.7.0. Check the vendor advisory for mitigations.

References

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-mAkmV4qc
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-mAkmV4qc

Get alerted when CVE-2020-3472 or the next vulnerability affects your stack