Cisco Webex Meetings Vulnerability Let Attackers Manipulate HTTP Responses
Cisco has disclosed a security vulnerability (CVE-2025-20255) affecting its Webex Meetings service, which could allow remote attackers to manipulate cached HTTP responses.
Cisco has disclosed a security vulnerability (CVE-2025-20255) affecting its Webex Meetings service, which could allow remote attackers to manipulate cached HTTP responses.
The vulnerability, with a CVSS score of 4.3 (Medium severity), arises from improper handling of malicious HTTP requests in the client join services component.
Security researcher Matthew B. Johnson (d3d) discovered and reported this HTTP cache poisoning vulnerability to Cisco.
The issue allows unauthenticated attackers to exploit cache behavior to deliver malicious content to Webex users. Cisco has already fixed the vulnerability in its cloud-based platform, requiring no action from customers.
Understanding HTTP Cache Poisoning Attacks
HTTP cache poisoning is an attack method where malicious actors exploit how web servers and caches process requests to deliver harmful content to users.
The attack consists of two main phases: first, triggering a response with a dangerous payload; second, ensuring the compromised response is cached and served to users.
The Webex Meetings vulnerability involves manipulating unkeyed inputs in HTTP requests. Web caches use specific components (cache keys) to identify resources, ignoring unkeyed inputs.
When unkeyed inputs affect the response but are not part of cache decision-making, attackers can inject payloads that modify responses for all users accessing the same cached resource.
A successful cache poisoning attack could impact numerous users without additional interaction from attackers.
Johnson (d3d) discovered and reported this HTTP cache poisoning vulnerability to Cisco.
The Webex vulnerability (CWE-349) allows attackers to manipulate HTTP responses by exploiting how the service handles malicious HTTP requests .
Unlike traditional cross-site scripting attacks, cache poisoning attacks leverage shared caching infrastructure to amplify impact.
The attack vector requires no authentication (AV:N) and has low attack complexity (AC:L), though it requires user interaction (UI:R) to complete the exploit chain.
While the vulnerability affects integrity (I:L), there are no reported confidentiality (C:N) or availability (A:N) concerns.
Attackers could potentially force the Webex Meetings service to return incorrect HTTP responses, leading to security issues like session disruption.
Risk Factors Details
Affected Products Cisco Webex Meetings (cloud-based service; no on-premises systems impacted)
Impact Integrity compromise via HTTP cache poisoning
Exploit Prerequisites No privileges required
CVSS 3.1 Score 4.3 (Medium)
Cisco has resolved the vulnerability in its cloud-based Webex Meetings service, and no customer action is required.
The Cisco Product Security Incident Response Team (PSIRT) reported no evidence of public exploitation at the time of disclosure.
Organizations using Cisco Webex Meetings should ensure they are using the latest service version, which includes the fix.
Security experts recommend validating and sanitizing all user inputs, especially HTTP headers, ensuring proper cache configuration, and considering implementing response headers like Vary to control caching behavior.
Based on reporting by Cyber Security News.