var-202009-1137
Vulnerability from variot
A vulnerability in the application protocol handling features of Cisco Jabber for Windows could allow an unauthenticated, remote attacker to execute arbitrary commands. The vulnerability is due to improper handling of input to the application protocol handlers. An attacker could exploit this vulnerability by convincing a user to click a link within a message sent by email or other messaging platform. A successful exploit could allow the attacker to execute arbitrary commands on a targeted system with the privileges of the user account that is running the Cisco Jabber client software. Windows for Cisco Jabber Has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Both Cisco Jabber for Windows and Cisco Jabber are products of Cisco. Cisco Jabber for Windows is a unified communication client solution for Windows platform. The program provides online status display, instant messaging, voice and other functions. Cisco Jabber is a unified communications client solution. The program provides online status display, instant messaging, voice and other functions. There is a security vulnerability in Cisco Jabber based on the Windows platform
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202009-1137",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "jabber",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "12.7"
},
{
"model": "jabber",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "12.6"
},
{
"model": "jabber",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "12.8.3"
},
{
"model": "jabber",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "12.7.2"
},
{
"model": "jabber",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "12.5"
},
{
"model": "jabber",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "12.9.1"
},
{
"model": "jabber",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "12.5.2"
},
{
"model": "jabber",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "12.9"
},
{
"model": "jabber",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "12.1"
},
{
"model": "jabber",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "12.1.3"
},
{
"model": "jabber",
"scope": "gte",
"trust": 1.0,
"vendor": "cisco",
"version": "12.8"
},
{
"model": "jabber",
"scope": "lt",
"trust": 1.0,
"vendor": "cisco",
"version": "12.6.3"
},
{
"model": "cisco jabber",
"scope": "eq",
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": null
},
{
"model": "cisco jabber",
"scope": null,
"trust": 0.8,
"vendor": "\u30b7\u30b9\u30b3\u30b7\u30b9\u30c6\u30e0\u30ba",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-010745"
},
{
"db": "NVD",
"id": "CVE-2020-3430"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:cisco:jabber:*:*:*:*:*:windows:*:*",
"cpe_name": [],
"versionEndExcluding": "12.9.1",
"versionStartIncluding": "12.9",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:jabber:*:*:*:*:*:windows:*:*",
"cpe_name": [],
"versionEndExcluding": "12.8.3",
"versionStartIncluding": "12.8",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:jabber:*:*:*:*:*:windows:*:*",
"cpe_name": [],
"versionEndExcluding": "12.7.2",
"versionStartIncluding": "12.7",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:jabber:*:*:*:*:*:windows:*:*",
"cpe_name": [],
"versionEndExcluding": "12.6.3",
"versionStartIncluding": "12.6",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:jabber:*:*:*:*:*:windows:*:*",
"cpe_name": [],
"versionEndExcluding": "12.5.2",
"versionStartIncluding": "12.5",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:jabber:*:*:*:*:*:windows:*:*",
"cpe_name": [],
"versionEndExcluding": "12.1.3",
"versionStartIncluding": "12.1",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2020-3430"
}
]
},
"cve": "CVE-2020-3430",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2020-3430",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-181555",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 2.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2020-3430",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "Required",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2020-3430",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "ykramarz@cisco.com",
"id": "CVE-2020-3430",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-202009-127",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-181555",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-181555"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010745"
},
{
"db": "NVD",
"id": "CVE-2020-3430"
},
{
"db": "NVD",
"id": "CVE-2020-3430"
},
{
"db": "CNNVD",
"id": "CNNVD-202009-127"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A vulnerability in the application protocol handling features of Cisco Jabber for Windows could allow an unauthenticated, remote attacker to execute arbitrary commands. The vulnerability is due to improper handling of input to the application protocol handlers. An attacker could exploit this vulnerability by convincing a user to click a link within a message sent by email or other messaging platform. A successful exploit could allow the attacker to execute arbitrary commands on a targeted system with the privileges of the user account that is running the Cisco Jabber client software. Windows for Cisco Jabber Has OS A command injection vulnerability exists.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Both Cisco Jabber for Windows and Cisco Jabber are products of Cisco. Cisco Jabber for Windows is a unified communication client solution for Windows platform. The program provides online status display, instant messaging, voice and other functions. Cisco Jabber is a unified communications client solution. The program provides online status display, instant messaging, voice and other functions. There is a security vulnerability in Cisco Jabber based on the Windows platform",
"sources": [
{
"db": "NVD",
"id": "CVE-2020-3430"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010745"
},
{
"db": "VULHUB",
"id": "VHN-181555"
}
],
"trust": 1.71
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2020-3430",
"trust": 2.5
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010745",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-202009-127",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2020.3026",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "49085",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-181555",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-181555"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010745"
},
{
"db": "NVD",
"id": "CVE-2020-3430"
},
{
"db": "CNNVD",
"id": "CNNVD-202009-127"
}
]
},
"id": "VAR-202009-1137",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-181555"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T13:01:35.916000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "cisco-sa-jabber-vY8M4KGB",
"trust": 0.8,
"url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-jabber-vy8m4kgb"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-010745"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-78",
"trust": 1.1
},
{
"problemtype": "OS Command injection (CWE-78) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-181555"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010745"
},
{
"db": "NVD",
"id": "CVE-2020-3430"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.3,
"url": "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-jabber-vy8m4kgb"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2020-3430"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/49085"
},
{
"trust": 0.6,
"url": "https://media.cert.europa.eu/static/securityadvisories/2020/cert-eu-sa2020-043.pdf"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.3026/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-181555"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010745"
},
{
"db": "NVD",
"id": "CVE-2020-3430"
},
{
"db": "CNNVD",
"id": "CNNVD-202009-127"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-181555"
},
{
"db": "JVNDB",
"id": "JVNDB-2020-010745"
},
{
"db": "NVD",
"id": "CVE-2020-3430"
},
{
"db": "CNNVD",
"id": "CNNVD-202009-127"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-09-04T00:00:00",
"db": "VULHUB",
"id": "VHN-181555"
},
{
"date": "2021-02-03T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2020-010745"
},
{
"date": "2020-09-04T03:15:10.013000",
"db": "NVD",
"id": "CVE-2020-3430"
},
{
"date": "2020-09-02T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202009-127"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-09-09T00:00:00",
"db": "VULHUB",
"id": "VHN-181555"
},
{
"date": "2021-02-03T02:26:00",
"db": "JVNDB",
"id": "JVNDB-2020-010745"
},
{
"date": "2023-11-07T03:22:42.457000",
"db": "NVD",
"id": "CVE-2020-3430"
},
{
"date": "2020-10-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-202009-127"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202009-127"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Windows\u00a0 for \u00a0Cisco\u00a0Jabber\u00a0 In \u00a0OS\u00a0 Command injection vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2020-010745"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "operating system commend injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-202009-127"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.