CVE-2020-3537
published 2020-09-04CVE-2020-3537: A vulnerability in Cisco Jabber for Windows software could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability…
PriorityP429medium5.7CVSS 3.1
AVNACLPRLUIRSUCHINAN
EPSS
1.27%
66.3th percentile
A vulnerability in Cisco Jabber for Windows software could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted messages that contain Universal Naming Convention (UNC) links to a targeted user and convincing the user to follow the provided link. A successful exploit could allow the attacker to cause the application to access a remote system, possibly allowing the attacker to gain access to sensitive information that the attacker could use in additional attacks.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| cisco | cisco_jabber | — | — |
| cisco | jabber | >= 12.1 < 12.1.3 | 12.1.3 |
| cisco | jabber | >= 12.5 < 12.5.2 | 12.5.2 |
| cisco | jabber | >= 12.6 < 12.6.3 | 12.6.3 |
| cisco | jabber | >= 12.7 < 12.7.2 | 12.7.2 |
| cisco | jabber | >= 12.8 < 12.8.3 | 12.8.3 |
| cisco | jabber | >= 12.9 < 12.9.1 | 12.9.1 |
| cisco | jabber_for_windows_universal_naming_convention_link_handling | — | — |
| nokogiri | nokogiri | >= 0 < 1.11.4 | 1.11.4 |
CVSS provenance
nvdv3.15.7MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:P/I:N/A:N
ghsa7.5HIGH
vendor_cisco5.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-fg68-5m2x-55qr: A vulnerability in Cisco Jabber for Windows software could allow an authenticated, remote attacker to gain access to sensitive information
ghsa_unreviewed·2022-05-24
CVE-2020-3537 [LOW] CWE-200 GHSA-fg68-5m2x-55qr: A vulnerability in Cisco Jabber for Windows software could allow an authenticated, remote attacker to gain access to sensitive information
A vulnerability in Cisco Jabber for Windows software could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted messages that contain Universal Naming Convention (UNC) links to a targeted user and convincing the user to follow the provided link. A successful exploit could allow the attacker to cause the application to access a remote system, possibly allowing the attacker to gain access to sensitive information that the attacker could use in additional attacks.
GHSA
Nokogiri updates packaged dependency on libxml2 from 2.9.10 to 2.9.12
ghsa·2021-05-17·CVSS 7.5
CVE-2019-20388 [HIGH] Nokogiri updates packaged dependency on libxml2 from 2.9.10 to 2.9.12
Nokogiri updates packaged dependency on libxml2 from 2.9.10 to 2.9.12
### Summary
Nokogiri v1.11.4 updates the vendored libxml2 from v2.9.10 to v2.9.12 which addresses:
- [CVE-2019-20388](https://security.archlinux.org/CVE-2019-20388) (Medium severity)
- [CVE-2020-24977](https://security.archlinux.org/CVE-2020-24977) (Medium severity)
- [CVE-2021-3517](https://security.archlinux.org/CVE-2021-3517) (Medium severity)
- [CVE-2021-3518](https://security.archlinux.org/CVE-2021-3518) (Medium severity)
- [CVE-2021-3537](https://security.archlinux.org/CVE-2021-3537) (Low severity)
- [CVE-2021-3541](https://security.archlinux.org/CVE-2021-3541) (Low severity)
Note that two additional CVEs were addressed upstream but are not relevant to this release. [CVE-2021-3516](https://security.archlinux.or
Cisco
Cisco Jabber for Windows Universal Naming Convention Link Handling Vulnerability
vendor_cisco·2020-09-02·CVSS 5.7
CVE-2020-3537 [MEDIUM] CWE-200 Cisco Jabber for Windows Universal Naming Convention Link Handling Vulnerability
Cisco Jabber for Windows Universal Naming Convention Link Handling Vulnerability
A vulnerability in Cisco Jabber for Windows software could allow an authenticated, remote attacker to gain access to sensitive information.
The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted messages that contain Universal Naming Convention (UNC) links to a targeted user and convincing the user to follow the provided link. A successful exploit could allow the attacker to cause the application to access a remote system, possibly allowing the attacker to gain access to sensitive information that the attacker could use in additional attacks.
Cisco has released software updates that address this vulnerability. There are n
Cisco
Cisco Jabber for Windows Universal Naming Convention Link Handling Vulnerability
vendor_cisco·CVSS 3.1
CVE-2020-3537 Cisco Jabber for Windows Universal Naming Convention Link Handling Vulnerability
CVE-2020-3537: Cisco Jabber for Windows Universal Naming Convention Link Handling Vulnerability
A vulnerability in Cisco Jabber for Windows software could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted messages that contain Universal Naming Convention (UNC) links to a targeted user and convincing the user to follow the provided link. A successful exploit could allow the attacker to cause the application to access a remote system, possibly allowing the attacker to gain access to sensitive information that the attacker could use in additional attacks. Cisco has released software updates that address this vulnerability
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-09-04
Published