Blog Elements | SecurityOrb.com

Half Sized Blog Element (Single Author Style)

Half Sized Blog Element (Multi Author Style)

UK’s Information Commissioner’s Office (ICO) Slap Fines on Facebook and Equifax

2018-11-05/1 Comment/in General Security/by Kellep Charles

Facebook was fined £500,000 by the UK’s Information Commissioner’s Office (ICO) for its role in the Cambridge Analytica data scandal.

Cisco WebEx Meetings Server XML External Entity (CVE-2018-18895)

2018-11-05/0 Comments/in Vulnerability/by Kellep Charles

UK’s Information Commissioner’s Office (ICO) Slap Fines on Facebook and Equifax

2018-11-05/1 Comment/in General Security/by Kellep Charles

Facebook was fined £500,000 by the UK’s Information Commissioner’s Office (ICO) for its role in the Cambridge Analytica data scandal.

Cisco WebEx Meetings Server XML External Entity (CVE-2018-18895)

2018-11-05/0 Comments/in Vulnerability/by Kellep Charles

UK fines Facebook £500,000 for failing to protect user data

Facebook was fined £500,000 by the UK’s Information Commissioner’s Office (ICO) for its role in the Cambridge Analytica data scandal which allowed unauthorized access of 87 million user information without sufficient consent.

The fine forced by the ICO was calculated using the UK’s old Data Protection Act 1998 which can impose a maximum penalty of £500,000 which represents a small fee for a company that brought in $40.7bn (£31.5bn) in global revenue in 2017. The penalty could have been much larger had it fallen under EU’s General Data Protection Regulation (GDPR), where a company could face a maximum fine of 20 million euros or 4% of its annual global revenue, whichever is higher, for such a privacy breach.

The investigation found that Facebook failed to keep the personal information of its users secure by failing to make suitable checks on developers using its platform.

Equifax recently faced a similar fine of £500,000 from its massive data breach that exposed personal and financial data of hundreds of millions of its customers.

DESCRIPTION

Cisco Webex Meetings Server includes a version of Castor XML that is affected by XXE. Because of that Cisco WebEx Meetings Server prior to versions 2.8MR3 and 3.0MR2 patch 1 are affected from XXE vulnerability. A remote unauthenticated attacker may lead to the disclosure of confidential data, denial of service, server side request forgery, port scanning from the perspective of the machine where the parser is located, and other system impacts by using this vulnerability.

Vulnerable path: /WBXServixe/XMLService

Vulnerable parametre: siteName

SOLUTION

Update current Cisco WebEx Meetings Server to 2.8MR3, 3.0MR2 patch 1, or the upcoming 4.0 release.

REFERENCES

You can find Cisco’s announcement from the link below:https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvm56811

You can find more information about XXE from the link below:https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing

Castor XML fixed this issue with CVE-2014-3004.

CREDIT

Alphan Yavas from Biznet Bilisim A.S.

Half Sized Blog Element (Single Author Style)

Half Sized Blog Element (Multi Author Style)

UK’s Information Commissioner’s Office (ICO) Slap Fines on Facebook and Equifax

Cisco WebEx Meetings Server XML External Entity (CVE-2018-18895)

UK’s Information Commissioner’s Office (ICO) Slap Fines on Facebook and Equifax

Cisco WebEx Meetings Server XML External Entity (CVE-2018-18895)

Full Sized Blog Element (Big Preview Pic)

UK’s Information Commissioner’s Office (ICO) Slap Fines on Facebook and Equifax

UK fines Facebook £500,000 for failing to protect user data

Cisco WebEx Meetings Server XML External Entity (CVE-2018-18895)

INTERESTING LINKS

Latest News

Business Hours