4.1

CVE-2020-3501

Multiple vulnerabilities in the user interface of Cisco Webex Meetings Desktop App could allow an authenticated, remote attacker to obtain restricted information from other Webex users. These vulnerabilities are due to improper input validation of parameters returned to the application from a web site. An attacker with a valid Webex account could exploit these vulnerabilities by persuading a user to follow a URL that is designed to return malicious path parameters to the affected software. A successful exploit could allow the attacker to obtain restricted information from other Webex users.

Data is provided by the National Vulnerability Database (NVD)
Cisco ≫ Webex Meetings Version < 39.5.24
Cisco ≫ Webex Meetings Version >= 40.4.0 < 40.4.6
Cisco ≫ Webex Meetings Version >= 40.4.10 < 40.6.0
Cisco ≫ Webex Meetings Version39.7.4
Cisco ≫ Webex Meetings Server Version3.0 Update-
Cisco ≫ Webex Meetings Server Version3.0 Updatemaintenance_release1
Cisco ≫ Webex Meetings Server Version3.0 Updatemaintenance_release2
Cisco ≫ Webex Meetings Server Version3.0 Updatemaintenance_release3
Cisco ≫ Webex Meetings Server Version4.0 Update-
Cisco ≫ Webex Meetings Server Version4.0 Updatemaintenance_release1
Cisco ≫ Webex Meetings Server Version4.0 Updatemaintenance_release2
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.16% 0.379
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 4.1 2.3 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
nvd@nist.gov 3.5 6.8 2.9
AV:N/AC:M/Au:S/C:P/I:N/A:N
psirt@cisco.com 4.1 2.3 1.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.