CVE-2020-3127

CWE-20 — Improper Input Validation4 documents4 sources

Severity

7.8HIGH

EPSS

0.6%

top 30.60%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Cisco Cisco Webex WRF Player Cisco Webex Meetings Cisco Webex Meetings Online +2 more

Timeline

PublishedMar 4

Latest updateMay 24

Description

Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerabilities are due to insufficient validation of certain elements within a Webex recording that is stored in either the Advanced Recording Format (ARF) or the Webex Recording Format (WRF). An attacker could exploit these vulnerabilities by sending a malicious ARF or WRF file to a user …

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

▶NVDcisco/webex_network_recording_player< 39.5.17+1

▶CVEListV5cisco/cisco_webex_wrf_playerunspecified — n/a

▶NVDcisco/webex_meetings39.5 — 39.5.17

▶NVDcisco/webex_meetings_online< 1.3.43

▶NVDcisco/webex_meetings_server< 3.0+2

🔴Vulnerability Details

GHSA

GHSA-xgp3-wq65-cw2g: Multiple vulnerabilities in Cisco Webex Network Recording Player for Microsoft Windows and Cisco Webex Player for Microsoft Windows could allow an att↗2022-05-24

▶

CVEList

Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities↗2020-03-04

▶

📋Vendor Advisories

Cisco

Cisco Webex Network Recording Player and Cisco Webex Player Arbitrary Code Execution Vulnerabilities↗2020-03-04

▶