CVE-2020-3430
published 2020-09-04CVE-2020-3430: A vulnerability in the application protocol handling features of Cisco Jabber for Windows could allow an unauthenticated, remote attacker to execute arbitrary…
PriorityP260high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
3.90%
89.1th percentile
A vulnerability in the application protocol handling features of Cisco Jabber for Windows could allow an unauthenticated, remote attacker to execute arbitrary commands. The vulnerability is due to improper handling of input to the application protocol handlers. An attacker could exploit this vulnerability by convincing a user to click a link within a message sent by email or other messaging platform. A successful exploit could allow the attacker to execute arbitrary commands on a targeted system with the privileges of the user account that is running the Cisco Jabber client software.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_jabber | — | — |
| cisco | jabber | >= 12.1 < 12.1.3 | 12.1.3 |
| cisco | jabber | >= 12.5 < 12.5.2 | 12.5.2 |
| cisco | jabber | >= 12.6 < 12.6.3 | 12.6.3 |
| cisco | jabber | >= 12.7 < 12.7.2 | 12.7.2 |
| cisco | jabber | >= 12.8 < 12.8.3 | 12.8.3 |
| cisco | jabber | >= 12.9 < 12.9.1 | 12.9.1 |
| cisco | jabber_for_windows_protocol_handler | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The attack vector is a malicious link delivered via email or other messaging platform that triggers Cisco Jabber's application protocol handler, leading to command injection. Monitor for suspicious invocations of Cisco Jabber protocol handlers (e.g., jabber://, xmpp://) originating from user clicks in email or messaging clients. ↗
- →The vulnerability is classified as OS Command Injection (CWE-78) via improper input handling in Cisco Jabber for Windows protocol handlers. Detect unexpected child processes spawned by the Cisco Jabber client process, which may indicate successful command injection. ↗
- →Successful exploitation results in arbitrary command execution under the privileges of the Jabber user account. Alert on cmd.exe, powershell.exe, or other shells spawned as child processes of the Cisco Jabber executable. ↗
- ·No workarounds are available for this vulnerability; patching is the only remediation. Ensure Cisco Jabber for Windows is updated to a fixed version as released by Cisco (tracked under Bug ID CSCvu96368). ↗
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
vendor_cisco8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Jabber for Windows Protocol Handler Command Injection Vulnerability
vendor_cisco·2020-09-02·CVSS 8.8
CVE-2020-3430 [HIGH] CWE-78 Cisco Jabber for Windows Protocol Handler Command Injection Vulnerability
Cisco Jabber for Windows Protocol Handler Command Injection Vulnerability
A vulnerability in the application protocol handling features of Cisco Jabber for Windows could allow an unauthenticated, remote attacker to execute arbitrary commands.
The vulnerability is due to improper handling of input to the application protocol handlers. An attacker could exploit this vulnerability by convincing a user to click a link within a message sent by email or other messaging platform. A successful exploit could allow the attacker to execute arbitrary commands on a targeted system with the privileges of the user account that is running the Cisco Jabber client software.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This a
Cisco
Cisco Jabber for Windows Protocol Handler Command Injection Vulnerability
vendor_cisco·CVSS 3.1
CVE-2020-3430 Cisco Jabber for Windows Protocol Handler Command Injection Vulnerability
CVE-2020-3430: Cisco Jabber for Windows Protocol Handler Command Injection Vulnerability
A vulnerability in the application protocol handling features of Cisco Jabber for Windows could allow an unauthenticated, remote attacker to execute arbitrary commands. The vulnerability is due to improper handling of input to the application protocol handlers. An attacker could exploit this vulnerability by convincing a user to click a link within a message sent by email or other messaging platform. A successful exploit could allow the attacker to execute arbitrary commands on a targeted system with the privileges of the user account that is running the Cisco Jabber client software. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.1
CWE: CWE-78, CWE-78
Bug IDs:
GHSA
GHSA-hqr6-633p-3x2j: A vulnerability in the application protocol handling features of Cisco Jabber for Windows could allow an unauthenticated, remote attacker to execute a
ghsa_unreviewed·2022-05-24
CVE-2020-3430 [HIGH] GHSA-hqr6-633p-3x2j: A vulnerability in the application protocol handling features of Cisco Jabber for Windows could allow an unauthenticated, remote attacker to execute a
A vulnerability in the application protocol handling features of Cisco Jabber for Windows could allow an unauthenticated, remote attacker to execute arbitrary commands. The vulnerability is due to improper handling of input to the application protocol handlers. An attacker could exploit this vulnerability by convincing a user to click a link within a message sent by email or other messaging platform. A successful exploit could allow the attacker to execute arbitrary commands on a targeted system with the privileges of the user account that is running the Cisco Jabber client software.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-09-04
Published