PT-2020-1887 · Cisco · Cisco Meeting Server

Published 2020-02-19 · Updated 2020-02-24 · CVE-2020-3160

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Cisco Meeting Server (affected versions not specified)

Description A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) feature could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition for users of XMPP conferencing applications. The issue is due to improper input validation of XMPP packets. An attacker could exploit this by sending crafted XMPP packets to an affected device, potentially causing process crashes and a DoS condition for XMPP conferencing applications.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-01163

CVE-2020-3160

Affected Products

Cisco Meeting Server

References · 4

• https://osv.dev/vulnerability/CVE-2020-3160 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3160 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cms-xmpp-dos-ptfGUsBx · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-01163 · Security Note