PT-2021-6881 · Cisco · Cisco Webex Meetings

Jeremy Heng · Published 2021-11-02 · Updated 2022-04-14 · CVE-2022-20763

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco Webex Meetings (affected versions not specified)

Description The issue is related to a vulnerability in the login authorization components of Cisco Webex Meetings, which could allow an authenticated, remote attacker to inject arbitrary Java code. This is due to improper deserialization of Java code within login requests. An attacker could exploit this by sending malicious login requests to the Cisco Webex Meetings service, potentially allowing them to inject arbitrary Java code and take arbitrary actions within the application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2022-02431

CVE-2022-20763

Affected Products

Cisco Webex Meetings

References · 8

• https://bdu.fstec.ru/vul/2022-02431 · Security Note
• https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-java-MVX6crH9 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20763 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20763 · Security Note
• https://t.me/cvenotify/28543 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2022040703 · Note
• https://vuldb.com/ru/?id.196612 · Note
• https://t.me/cibsecurity/40252 · Telegram Post