Security readout for executives and security teams
Plain-English summary
This Cisco Webex Centers flaw can let an unauthenticated internet user confirm whether guessed usernames exist and reveal a user’s real name. It is not a system takeover issue, but it can improve targeting for phishing, password spraying, and social engineering against Webex users.
Executive priority
Treat this as a moderate-priority exposure reduction task. It does not suggest immediate compromise, but it can materially improve attacker targeting. Prioritize confirmation and remediation for externally reachable Webex Center deployments and pair that with monitoring for credential attacks.
Technical view
CVE-2019-15987 is an information disclosure issue in the web interface for Cisco Webex Event, Meeting, Support, and Training Center. Missing CAPTCHA protection on certain URLs allows unauthenticated remote username guessing through crafted web requests. Successful exploitation discloses username validity and the user’s real name. CVSS is 5.3, network exploitable, low complexity, no privileges or user interaction required.
Likely exposure
Exposure is most likely for organizations using the named Cisco Webex Centers with internet-reachable web interfaces. The source bundle does not specify affected versions, deployment models, or exact fixed releases, so teams should verify status against Cisco’s advisory and their Webex inventory.
Exploitation context
The bundle does not cite active exploitation, and KEV status is false. The practical risk is reconnaissance: attackers can validate account names and real names before phishing, credential stuffing, or password spraying. The vulnerability alone does not provide authentication bypass or code execution.
Researcher notes
The evidence supports unauthenticated remote username enumeration caused by missing CAPTCHA protection. Affected versions and fixed-release details are not included in the prompt bundle. Do not assume active exploitation or additional impacted Cisco products without vendor or authoritative confirmation.
Mitigation direction
- Review Cisco’s advisory for affected and fixed release guidance.
- Apply Cisco-recommended updates or remediation for affected Webex Centers.
- Confirm unsupported or unused Webex Center services are retired.
- Monitor authentication systems for password spraying against enumerated accounts.
- Strengthen MFA and phishing-resistant controls for Webex user accounts.
Validation and detection
- Inventory Webex Event, Meeting, Support, and Training Center usage.
- Compare versions and service status with Cisco’s advisory.
- Review web and identity logs for unusual username lookup patterns.
- Check for follow-on failed logins against exposed Webex accounts.
- Document whether each affected service is patched, mitigated, or retired.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-287: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2019-15987 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N3.91.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
5.3MediumVector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- 20191120 Cisco WebEx Centers Username Enumeration Information Disclosure VulnerabilityCVE reference · vendor-advisory, x_refsource_CISCO
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Authentication
Improper Authentication represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.