PT-2020-3848 · Cisco · Cisco Webex Training

Eric Merrill · Published 2020-09-03 · Updated 2021-10-19 · CVE-2020-3542

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Webex Training (affected versions not specified)

Description: The issue is related to improper validation of input to API requests, allowing an authenticated, remote attacker to join a password-protected meeting without providing the meeting password. This could be achieved by sending an API request that returns a URL with a prepopulated meeting join page, including the meeting username and password. A successful exploit would allow the attacker to join the meeting and be visible in the attendee list. The vulnerability is also described as being related to insufficient validation of input data, which could enable a remote attacker to gain unauthorized access to protected information.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-04210

CVE-2020-3542

Affected Products

Cisco Webex Training

References · 4

• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-meetings-UtbwOR4Q · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04210 · Security Note
• https://osv.dev/vulnerability/CVE-2020-3542 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3542 · Security Note