PT-2020-4956 · Cisco · Cisco Webex Meetings Server+1

Dhilung Kirat + 3 · Published 2020-11-18 · Updated 2021-08-06 · CVE-2020-3471

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Webex Meetings and Cisco Webex Meetings Server (affected versions not specified)

Description The issue is related to insufficient input validation, allowing a remote attacker to gain unauthorized access to protected information. It is also due to a synchronization issue between meeting and media services on a vulnerable Webex site. An attacker could exploit this by sending crafted requests to a vulnerable site, potentially maintaining bidirectional audio despite being expelled from an active Webex session.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-662

CWE-20

Related Identifiers

BDU:2020-05531

CVE-2020-3471

Affected Products

Cisco Webex Meetings

Cisco Webex Meetings Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2020-3471 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-info-leak-PhpzB3sG · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3471 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-05531 · Security Note
• https://t.me/cibsecurity/16557 · Telegram Post
• https://t.me/cibsecurity/17391 · Telegram Post