CVE-2025-20255

Published May 21, 2025

Last updated 7 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-20255 is a vulnerability found in the client join services of Cisco Webex Meetings. This flaw allows an unauthenticated, remote attacker to manipulate cached HTTP responses within the meeting join service. The root cause of this vulnerability is the improper handling of malicious HTTP requests by the affected service. An attacker can exploit this vulnerability through a technique known as HTTP cache poisoning, where they manipulate stored HTTP responses. A successful exploit could result in the Webex Meetings service delivering incorrect HTTP responses to clients attempting to join meetings.

Description: A vulnerability in client join services of Cisco Webex Meetings could allow an unauthenticated, remote attacker to manipulate cached HTTP responses within the meeting join service. This vulnerability is due to improper handling of malicious HTTP requests to the affected service. An attacker could exploit this vulnerability by manipulating stored HTTP responses within the service, also known as HTTP cache poisoning. A successful exploit could allow the attacker to cause the Webex Meetings service to return incorrect HTTP responses to clients.
Source: psirt@cisco.com
NVD status: Analyzed
Products: webex_meetings

Risk scores

CVSS 3.1

Type: Primary
Base score: 4.3
Impact score: 1.4
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Severity: MEDIUM

Weaknesses

psirt@cisco.com: CWE-349

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 3

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:cisco:webex_meetings:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "81774C03-0884-44C6-80EF-DC882BF44C84"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.