PT-2019-3259 · Cisco · Cisco Jabber Client Framework For Mac

Published 2019-09-04 · Updated 2020-10-08 · CVE-2019-12645

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Jabber Client Framework for Mac (affected versions not specified)

Description The issue is related to improper file level permissions, allowing an authenticated, local attacker to execute arbitrary code on an affected device. An attacker could exploit this by authenticating to the device and executing arbitrary code or modifying certain configuration files. A successful exploit could allow the attacker to execute arbitrary code or modify configuration files using the privileges of the installed Cisco JCF for Mac Software.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

RCE

Weakness Enumeration

CWE-732

CWE-20

Related Identifiers

BDU:2019-03250

CVE-2019-12645

Affected Products

Cisco Jabber Client Framework For Mac

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190904-jcf-codex · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12645 · Security Note
• https://osv.dev/vulnerability/CVE-2019-12645 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03250 · Security Note