CVE-2017-3823
Quick assessment
Affected
n/a Cisco WebEx browser extensions
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Cisco WebEx是美国思科（Cisco）公司的一套Web会议工具，该工具可协助异地办公人员进行协调合作。WebEx服务包括Web会议、网真视频会议和企业即时消息(IM)等。 Cisco WebEx extensions和plugins存在安全漏洞。远程攻击者可通过诱使用户打开恶意的网页或链接利用该漏洞执行任意代码。以下产品和版本受到影响：基于Google Chrome平台的Cisco WebEx Extension 1.0.7之前的版本；基于Mozilla Firefox平台的ActiveTouch
Public Exploits 1
Metasploit · 1
cisco_webex_ext.rb [exploit]
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2017-3823
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on Mozilla Firefox, the GpcContainer Class ActiveX control plugin before 10031.6.2017.0126 on Internet Explorer, and the Download Manager ActiveX control plugin before 2.1.0.10 on Internet Explorer. A vulnerability in these Cisco WebEx browser extensions could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. This vulnerability affects the browser extensions for Cisco WebEx Meetings Server and Cisco WebEx Centers (Meeting Center, Event Center, Training Center, and Support Center) when they are running on Microsoft Windows. The vulnerability is a design defect in an application programing interface (API) response parser within the extension. An attacker that can convince an affected user to visit an attacker-controlled web page or follow an attacker-supplied link with an affected browser could exploit the vulnerability. If successful, the attacker could execute arbitrary code with the privileges of the affected browser.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
内存缓冲区边界内操作的限制不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Cisco WebEx extensions和plugins 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Cisco WebEx是美国思科（Cisco）公司的一套Web会议工具，该工具可协助异地办公人员进行协调合作。WebEx服务包括Web会议、网真视频会议和企业即时消息(IM)等。 Cisco WebEx extensions和plugins存在安全漏洞。远程攻击者可通过诱使用户打开恶意的网页或链接利用该漏洞执行任意代码。以下产品和版本受到影响：基于Google Chrome平台的Cisco WebEx Extension 1.0.7之前的版本；基于Mozilla Firefox平台的ActiveTouch
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | Cisco WebEx browser extensions | Cisco WebEx browser extensions | - |
|
II. Public POCs for CVE-2017-3823
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2017-3823
请登录查看更多情报信息。
Vendor Advisories for CVE-2017-3823 (4)
Security Blog Posts for CVE-2017-3823 (1)
-
🔗 https://blog.filippo.io/webex-extension-vulnerability/ x_refsource_MISC
Other References for CVE-2017-3823 (3)
-
🔗 https://bugs.chromium.org/p/project-zero/issues/detail?id=1100 x_refsource_MISC
-
https://bugs.chromium.org/p/project-zero/issues/detail?id=1096 x_refsource_MISC
-
Same Patch Batch · n/a · 2017-02-01 · 13 CVEs total
| CVE-2017-5630 | PEAR Base System 安全漏洞 | |
| CVE-2016-2938 | IBM iNotes和Domino 跨站脚本漏洞 | |
| CVE-2016-5884 | IBM iNotes和Domino 跨站脚本漏洞 | |
| CVE-2016-10079 | SAP GUI SAPlpd 安全漏洞 | |
| CVE-2016-9225 | Cisco Adaptive Security Appliance CX Context-Aware Security模块安全漏洞 | |
| CVE-2017-3790 | Cisco Expressway Series Software和Cisco TelePresence VCS Software 安全漏洞 | |
| CVE-2017-3791 | Cisco Prime Home 安全漏洞 | |
| CVE-2017-3792 | 多款Cisco产品Cisco TelePresence Software 输入验证漏洞 | |
| CVE-2016-10164 | libXpm 数字错误漏洞 | |
| CVE-2016-10173 | minitar 路径遍历漏洞 | |
| CVE-2016-4038 | Samsung手机安全漏洞 | |
| CVE-2016-9963 | Exim 安全漏洞 |
IV. Related Vulnerabilities
Same vendor: n/a
-
CVE-2026-94148
ScadaBR Export Project Endpoint export_project.htm EmportDwr -
CVE-2026-94110
QCMS Content Detail Controllers.php self_Tmp sql injection -
CVE-2026-94103
RooCMS Frontend Rendering site_pagePHP.php eval code injecti -
CVE-2026-94102
WuzhiCMS Login index.php redirect -
CVE-2026-94094
OpenClaw Canvas Host Route server.ts createCanvasHostHandler
Same weakness: CWE-119
-
CVE-2026-20352
Cisco Identity Services Engine RADIUS Denial of Service Vuln -
CVE-2026-92178
pdfforge PDF Architect PDF File Parsing Memory Corruption Re -
CVE-2026-19886
OriginLab Origin Viewer OGM File Parsing Memory Corruption R -
CVE-2026-91091
GPAC Node Insertion base_scenegraph.c gf_node_list_insert_ch -
CVE-2026-90831
GNU Binutils ELF String Table elf-strtab.c _bfd_elf_strtab_d
V. Comments for CVE-2017-3823
No comments yet