PT-2020-1373 · Cisco · Cisco Webex Teams

Published 2020-01-22 · Updated 2020-01-28 · CVE-2020-3131

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Cisco Webex Teams client for Windows version 3.0.13131

Description A vulnerability in the Cisco Webex Teams client for Windows could allow an authenticated, remote attacker to cause the client to crash, resulting in a denial of service (DoS) condition. The attacker needs a valid developer account to exploit this vulnerability. The issue is due to insufficient input validation when processing received adaptive cards. An attacker could exploit this by sending an adaptive card with malicious content to an existing user of the Cisco Webex Teams client for Windows, potentially causing the targeted user's client to crash continuously.

Recommendations For Cisco Webex Teams client for Windows version 3.0.13131, consider updating to a version that fixes the issue with insufficient input validation for adaptive cards, although the specific fixed version is not provided in the available information. As a temporary workaround, restricting the receipt of adaptive cards from untrusted sources may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

BDU:2020-00321

CVE-2020-3131

Affected Products

Cisco Webex Teams

References · 4

• https://bdu.fstec.ru/vul/2020-00321 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-3131 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cards-dos-FWzNcXPq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3131 · Vendor Advisory