PT-2021-3323 · Cisco · Cisco Jabber For Mac+2

Torjus Bryne Retterstøl · Published 2021-06-16 · Updated 2022-04-25 · CVE-2021-1569

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Cisco Jabber for Windows (affected versions not specified) Cisco Jabber for Mac (affected versions not specified) Cisco Jabber for mobile platforms (affected versions not specified)

Description The issue is related to insufficient protection of registration data, which could allow a remote attacker to gain unauthorized access to sensitive information using a specially crafted XMPP message. This could also lead to a denial of service (DoS) condition, allowing an attacker to access sensitive information.

Recommendations For Cisco Jabber for Windows, consider restricting access to sensitive information until a fix is available. For Cisco Jabber for Mac, avoid using the platform with untrusted XMPP messages until the issue is resolved. For Cisco Jabber for mobile platforms, restrict the use of the platform in untrusted environments to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Insufficiently Protected Credentials

Weakness Enumeration

CWE-20

CWE-399

CWE-522

Related Identifiers

BDU:2021-03116

CVE-2021-1569

Affected Products

Cisco Jabber For Mac

Cisco Jabber For Windows

Cisco Jabber For Mobile

References · 4

• https://osv.dev/vulnerability/CVE-2021-1569 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-1569 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-GuC5mLwG · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03116 · Security Note