PT-2019-1538 · Cisco · Cisco Webex Teams

Published 2019-02-20 · Updated 2023-03-23 · CVE-2019-1689

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Webex Teams versions prior to 3.13.26920

Description The issue is related to improper input validation in the client application, allowing an authenticated, remote attacker to upload arbitrary files within the scope of the iOS application. An attacker could exploit this by sending a malicious file to a targeted user and persuading the user to manually open it, potentially overwriting sensitive application files and causing a denial of service (DoS) condition. This could result in the targeted user being unable to access the system in the future.

Recommendations For versions prior to 3.13.26920, update to version 3.13.26920 to resolve the issue. As a temporary workaround, consider restricting the ability to upload and open files within the application to minimize the risk of exploitation. Avoid opening suspicious files received through the application until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2019-01037

CVE-2019-1689

Affected Products

Cisco Webex Teams

References · 5

• 🔥 https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-webx-ios-file · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-1689 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1689 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01037 · Security Note
• http://securityfocus.com/bid/107101 · Note