Cisco Jabber for Windows Protocol Handler Command Injection (cisco-sa-jabber-vY8M4KGB)

high Nessus Plugin ID 140219

Language:

Synopsis

The remote device is missing a vendor-supplied security patch

Description

According to its self-reported version, Cisco Jabber for Windows is affected by a Windows Protocol Handler Command Injection vulnerability. The vulnerability exists in the web-based user interface due to improper handling of input to the application protocol handlers. An unathenticated, remote attacker can exploit this via a emailed or messaged link to execute arbitrary commands on a targeted system with the privileges of the user account.

Please see the included Cisco BIDs and Cisco Security Advisory for more information.

Solution

Upgrade to the relevant fixed version referenced in Cisco bug ID CSCvu96368

Plugin Details

Severity: High

ID: 140219

File Name: cisco-sa-jabber-vY8M4KGB.nasl

Version: 1.5

Type: local

Agent: windows

Family: Windows

Published: 9/4/2020

Updated: 12/18/2020

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 9.3

Temporal Score: 6.9

Vector: CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2020-3430

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:cisco:jabber

Required KB Items: installed_sw/Cisco Jabber for Windows

Exploit Ease: No known exploits are available

Patch Publication Date: 9/2/2020

Vulnerability Publication Date: 9/2/2020

Reference Information

CVE: CVE-2020-3430

CISCO-SA: cisco-sa-jabber-vY8M4KGB

IAVA: 2020-A-0399-S

CISCO-BUG-ID: CSCvu96368

Detections

Analytics