PT-2020-2866 · Cisco · Cisco Webex Meetings Desktop App

Published 2020-06-17 · Updated 2020-06-24 · CVE-2020-3342

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Cisco Webex Meetings Desktop App for Mac (affected versions not specified)

Description A vulnerability in the software update feature could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. The issue is due to improper validation of cryptographic protections on files downloaded by the application as part of a software update. An attacker could exploit this by persuading a user to visit a website that returns files similar to those from a valid Webex website, potentially causing the client to fail in properly validating the cryptographic protections before executing them as part of an update. A successful exploit could allow the attacker to execute arbitrary code with the privileges of the user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BDU:2020-03020

CVE-2020-3342

Affected Products

Cisco Webex Meetings Desktop App

References · 5

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-client-mac-X7vp65BL · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03020 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3342 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3342 · Security Note
• https://t.me/cvenotify/4460 · Telegram Post