CVE:CVE-2015-4262
CNNVD:CNNVD-201507-737
Cisco Unified MeetingPlace Web Conferencing是美国思科（Cisco）公司的一个Cisco Unified MeetingPlace多媒体会议解决方案中的核心组件。
Cisco Unified MeetingPlace Web Conferencing 8.5(5) MR3之前8.5版本和8.6(2)之前8.6版本的password-change功能中存在安全漏洞，该漏洞源于程序在处理password-change请求时没有要求输入当前密码；程序中的HTTP会话功能没有验证HTTP请求中的会话ID。远程攻击者可通过发送特制的HTTP请求利用该漏洞重置任意密码。
solution:Upgrade cisco unified_meetingplace_web_conferencing to a higher version than 6.0.417.0,6.0_base,7.0(1,7.0(2,7.0(2_sr1,7.0(3,7.1(1,7.1(2,8.0(1,8.0(1_sr1,8.0(2,8.5(1,8.5(2,8.5(2_sr1,8.5(2_sr2,8.5(3,8.5(4,and avoid the version 6.0.417.0,6.0_base,7.0(1),7.0(2),7.0(2)_sr1,7.0(3),7.1(1),7.1(2),8.0(1),8.0(1)_sr1,8.0(2),8.5(1),8.5(2),8.5(2)_sr1,8.5(2)_sr2,8.5(3),8.5(4)