PT-2020-3845 · Cisco · Cisco Jabber For Windows

Published 2020-09-03 · Updated 2020-09-09 · CVE-2020-3430

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Cisco Jabber for Windows (affected versions not specified)

Description: A vulnerability in the application protocol handling features of Cisco Jabber for Windows could allow an unauthenticated, remote attacker to execute arbitrary commands. The issue is due to improper handling of input to the application protocol handlers. An attacker could exploit this by convincing a user to click a link within a message sent by email or other messaging platform, potentially allowing the execution of arbitrary commands on a targeted system with the privileges of the user account running the Cisco Jabber client software.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2020-04207

CVE-2020-3430

Affected Products

Cisco Jabber For Windows

References · 5

• https://osv.dev/vulnerability/CVE-2020-3430 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3430 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-vY8M4KGB · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04207 · Security Note
• https://t.me/cybersecuritytechnologies/1696 · Telegram Post