PT-2020-4647 · Cisco · Cisco Webex Teams

Elber Tavares · Published 2020-11-04 · Updated 2025-08-01 · CVE-2020-26067

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Webex Teams (affected versions not specified)

Description A vulnerability in the web-based interface of Cisco Webex Teams could allow an authenticated, remote attacker to conduct cross-site scripting attacks. The issue is due to improper validation of usernames, allowing an attacker to create an account with malicious HTML or script content and join a space using the malicious account name. This could enable the attacker to conduct cross-site scripting attacks and potentially gain access to sensitive browser-based information.

Recommendations For all affected versions, update to the latest software version released by Cisco, as it addresses this vulnerability. At the moment, there is no information about additional mitigation measures or workarounds that address this vulnerability.

Fix

XSS

Weakness Enumeration

CWE-80

Related Identifiers

BDU:2020-05199

CVE-2020-26067

Affected Products

Cisco Webex Teams

References · 7

• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-teams-xss-zLW9tD3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26067 · Security Note
• https://bdu.fstec.ru/vul/2020-05199 · Security Note
• https://t.me/cveNotify/130616 · Telegram Post
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-teams-xss-zLW9tD3 · Note
• https://t.me/cvedetector/11371 · Telegram Post
• https://twitter.com/CVEnew/status/1858546000048070739 · Twitter Post