CVE-2020-3498
published 2020-09-04CVE-2020-3498: A vulnerability in Cisco Jabber software could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to…
PriorityP337medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
1.85%
76.7th percentile
A vulnerability in Cisco Jabber software could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted messages to a targeted system. A successful exploit could allow the attacker to cause the application to return sensitive authentication information to another system, possibly for use in further attacks.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_jabber | — | — |
| cisco | jabber | >= 12.1 < 12.1.3 | 12.1.3 |
| cisco | jabber | >= 12.5 < 12.5.2 | 12.5.2 |
| cisco | jabber | >= 12.6 < 12.6.3 | 12.6.3 |
| cisco | jabber | >= 12.7 < 12.7.2 | 12.7.2 |
| cisco | jabber | >= 12.8 < 12.8.3 | 12.8.3 |
| cisco | jabber | >= 12.9 < 12.9.1 | 12.9.1 |
| cisco | jabber_for_windows | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_cisco6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Cisco
Cisco Jabber for Windows Information Disclosure Vulnerability
vendor_cisco·2020-09-02·CVSS 6.5
CVE-2020-3498 [MEDIUM] CWE-200 Cisco Jabber for Windows Information Disclosure Vulnerability
Cisco Jabber for Windows Information Disclosure Vulnerability
A vulnerability in Cisco Jabber software could allow an authenticated, remote attacker to gain access to sensitive information.
The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted messages to a targeted system. A successful exploit could allow the attacker to cause the application to return sensitive authentication information to another system, possibly for use in further attacks.
Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
This advisory is available at the following link:https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-
Cisco
Cisco Jabber for Windows Information Disclosure Vulnerability
vendor_cisco·CVSS 3.1
CVE-2020-3498 Cisco Jabber for Windows Information Disclosure Vulnerability
CVE-2020-3498: Cisco Jabber for Windows Information Disclosure Vulnerability
A vulnerability in Cisco Jabber software could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted messages to a targeted system. A successful exploit could allow the attacker to cause the application to return sensitive authentication information to another system, possibly for use in further attacks. Cisco has released software updates that address this vulnerability. There are no
CVSS: 3.1
CWE: CWE-200, CWE-200
Bug IDs: CSCvu71180
GHSA
GHSA-629q-m7cg-wch9: A vulnerability in Cisco Jabber software could allow an authenticated, remote attacker to gain access to sensitive information
ghsa_unreviewed·2022-05-24
CVE-2020-3498 [MEDIUM] CWE-20 GHSA-629q-m7cg-wch9: A vulnerability in Cisco Jabber software could allow an authenticated, remote attacker to gain access to sensitive information
A vulnerability in Cisco Jabber software could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted messages to a targeted system. A successful exploit could allow the attacker to cause the application to return sensitive authentication information to another system, possibly for use in further attacks.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-09-04
Published