var-202012-0620
Vulnerability from variot

Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system (OS) with elevated privileges or gain access to sensitive information. For more information about these vulnerabilities, see the Details section of this advisory. Cisco Jabber is a set of unified communication client solutions of Cisco (Cisco). The program provides online status display, instant messaging, voice and other functions. An authorization issue vulnerability exists in Cisco Jabber. The vulnerability is caused by the software allowing unauthenticated users to execute commands and improper handling of input to the application protocol handler. Execute arbitrary commands on the target system without the privileges of the client software's user account

Show details on source website


{
   "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
      affected_products: {
         "@id": "https://www.variotdbs.pl/ref/affected_products",
      },
      configurations: {
         "@id": "https://www.variotdbs.pl/ref/configurations",
      },
      credits: {
         "@id": "https://www.variotdbs.pl/ref/credits",
      },
      cvss: {
         "@id": "https://www.variotdbs.pl/ref/cvss/",
      },
      description: {
         "@id": "https://www.variotdbs.pl/ref/description/",
      },
      exploit_availability: {
         "@id": "https://www.variotdbs.pl/ref/exploit_availability/",
      },
      external_ids: {
         "@id": "https://www.variotdbs.pl/ref/external_ids/",
      },
      iot: {
         "@id": "https://www.variotdbs.pl/ref/iot/",
      },
      iot_taxonomy: {
         "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/",
      },
      patch: {
         "@id": "https://www.variotdbs.pl/ref/patch/",
      },
      problemtype_data: {
         "@id": "https://www.variotdbs.pl/ref/problemtype_data/",
      },
      references: {
         "@id": "https://www.variotdbs.pl/ref/references/",
      },
      sources: {
         "@id": "https://www.variotdbs.pl/ref/sources/",
      },
      sources_release_date: {
         "@id": "https://www.variotdbs.pl/ref/sources_release_date/",
      },
      sources_update_date: {
         "@id": "https://www.variotdbs.pl/ref/sources_update_date/",
      },
      threat_type: {
         "@id": "https://www.variotdbs.pl/ref/threat_type/",
      },
      title: {
         "@id": "https://www.variotdbs.pl/ref/title/",
      },
      type: {
         "@id": "https://www.variotdbs.pl/ref/type/",
      },
   },
   "@id": "https://www.variotdbs.pl/vuln/VAR-202012-0620",
   affected_products: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
            "@id": "https://www.variotdbs.pl/ref/sources",
         },
      },
      data: [
         {
            model: "jabber for mobile platforms",
            scope: "eq",
            trust: 1,
            vendor: "cisco",
            version: "12.9\\(1\\)",
         },
         {
            model: "jabber for mobile platforms",
            scope: "eq",
            trust: 1,
            vendor: "cisco",
            version: "12.9\\(2\\)",
         },
         {
            model: "jabber for mobile platforms",
            scope: "eq",
            trust: 1,
            vendor: "cisco",
            version: "12.9\\(0\\)",
         },
         {
            model: "jabber",
            scope: "eq",
            trust: 1,
            vendor: "cisco",
            version: "12.9\\(3\\)",
         },
         {
            model: "jabber",
            scope: "eq",
            trust: 1,
            vendor: "cisco",
            version: "12.9\\(1\\)",
         },
         {
            model: "jabber",
            scope: "eq",
            trust: 1,
            vendor: "cisco",
            version: "12.9\\(2\\)",
         },
         {
            model: "jabber",
            scope: "eq",
            trust: 1,
            vendor: "cisco",
            version: "12.9\\(0\\)",
         },
         {
            model: "jabber for mobile platforms",
            scope: "eq",
            trust: 1,
            vendor: "cisco",
            version: "12.9\\(3\\)",
         },
         {
            model: "cisco jabber",
            scope: "eq",
            trust: 0.8,
            vendor: "シスコシステムズ",
            version: null,
         },
         {
            model: "cisco jabber",
            scope: null,
            trust: 0.8,
            vendor: "シスコシステムズ",
            version: null,
         },
      ],
      sources: [
         {
            db: "JVNDB",
            id: "JVNDB-2020-014182",
         },
         {
            db: "NVD",
            id: "CVE-2020-27133",
         },
      ],
   },
   configurations: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/configurations#",
         children: {
            "@container": "@list",
         },
         cpe_match: {
            "@container": "@list",
         },
         data: {
            "@container": "@list",
         },
         nodes: {
            "@container": "@list",
         },
      },
      data: [
         {
            CVE_data_version: "4.0",
            nodes: [
               {
                  children: [],
                  cpe_match: [
                     {
                        cpe23Uri: "cpe:2.3:a:cisco:jabber:12.9\\(0\\):*:*:*:*:macos:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:cisco:jabber:12.9\\(1\\):*:*:*:*:macos:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:cisco:jabber:12.9\\(2\\):*:*:*:*:macos:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:cisco:jabber:12.9\\(3\\):*:*:*:*:macos:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:cisco:jabber:12.9\\(0\\):*:*:*:*:windows:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:cisco:jabber:12.9\\(1\\):*:*:*:*:windows:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:cisco:jabber:12.9\\(2\\):*:*:*:*:windows:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:cisco:jabber:12.9\\(3\\):*:*:*:*:windows:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:cisco:jabber_for_mobile_platforms:12.9\\(0\\):*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:cisco:jabber_for_mobile_platforms:12.9\\(1\\):*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:cisco:jabber_for_mobile_platforms:12.9\\(2\\):*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                     {
                        cpe23Uri: "cpe:2.3:a:cisco:jabber_for_mobile_platforms:12.9\\(3\\):*:*:*:*:*:*:*",
                        cpe_name: [],
                        vulnerable: true,
                     },
                  ],
                  operator: "OR",
               },
            ],
         },
      ],
      sources: [
         {
            db: "NVD",
            id: "CVE-2020-27133",
         },
      ],
   },
   cve: "CVE-2020-27133",
   cvss: {
      "@context": {
         cvssV2: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#",
            },
            "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2",
         },
         cvssV3: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#",
            },
            "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/",
         },
         severity: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/cvss/severity#",
            },
            "@id": "https://www.variotdbs.pl/ref/cvss/severity",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
            "@id": "https://www.variotdbs.pl/ref/sources",
         },
      },
      data: [
         {
            cvssV2: [
               {
                  acInsufInfo: false,
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "SINGLE",
                  author: "NVD",
                  availabilityImpact: "COMPLETE",
                  baseScore: 9,
                  confidentialityImpact: "COMPLETE",
                  exploitabilityScore: 8,
                  impactScore: 10,
                  integrityImpact: "COMPLETE",
                  obtainAllPrivilege: false,
                  obtainOtherPrivilege: false,
                  obtainUserPrivilege: false,
                  severity: "HIGH",
                  trust: 1,
                  userInteractionRequired: false,
                  vectorString: "AV:N/AC:L/Au:S/C:C/I:C/A:C",
                  version: "2.0",
               },
               {
                  acInsufInfo: null,
                  accessComplexity: "Low",
                  accessVector: "Network",
                  authentication: "Single",
                  author: "NVD",
                  availabilityImpact: "Complete",
                  baseScore: 9,
                  confidentialityImpact: "Complete",
                  exploitabilityScore: null,
                  id: "CVE-2020-27133",
                  impactScore: null,
                  integrityImpact: "Complete",
                  obtainAllPrivilege: null,
                  obtainOtherPrivilege: null,
                  obtainUserPrivilege: null,
                  severity: "High",
                  trust: 0.9,
                  userInteractionRequired: null,
                  vectorString: "AV:N/AC:L/Au:S/C:C/I:C/A:C",
                  version: "2.0",
               },
               {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "SINGLE",
                  author: "VULHUB",
                  availabilityImpact: "COMPLETE",
                  baseScore: 9,
                  confidentialityImpact: "COMPLETE",
                  exploitabilityScore: 8,
                  id: "VHN-370513",
                  impactScore: 10,
                  integrityImpact: "COMPLETE",
                  severity: "HIGH",
                  trust: 0.1,
                  vectorString: "AV:N/AC:L/AU:S/C:C/I:C/A:C",
                  version: "2.0",
               },
            ],
            cvssV3: [
               {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  author: "NVD",
                  availabilityImpact: "HIGH",
                  baseScore: 9.9,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  exploitabilityScore: 3.1,
                  impactScore: 6,
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  trust: 2,
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               {
                  attackComplexity: "Low",
                  attackVector: "Network",
                  author: "NVD",
                  availabilityImpact: "High",
                  baseScore: 9.9,
                  baseSeverity: "Critical",
                  confidentialityImpact: "High",
                  exploitabilityScore: null,
                  id: "CVE-2020-27133",
                  impactScore: null,
                  integrityImpact: "High",
                  privilegesRequired: "Low",
                  scope: "Changed",
                  trust: 0.8,
                  userInteraction: "None",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.0",
               },
            ],
            severity: [
               {
                  author: "NVD",
                  id: "CVE-2020-27133",
                  trust: 1.8,
                  value: "CRITICAL",
               },
               {
                  author: "ykramarz@cisco.com",
                  id: "CVE-2020-27133",
                  trust: 1,
                  value: "CRITICAL",
               },
               {
                  author: "CNNVD",
                  id: "CNNVD-202012-855",
                  trust: 0.6,
                  value: "CRITICAL",
               },
               {
                  author: "VULHUB",
                  id: "VHN-370513",
                  trust: 0.1,
                  value: "HIGH",
               },
               {
                  author: "VULMON",
                  id: "CVE-2020-27133",
                  trust: 0.1,
                  value: "HIGH",
               },
            ],
         },
      ],
      sources: [
         {
            db: "VULHUB",
            id: "VHN-370513",
         },
         {
            db: "VULMON",
            id: "CVE-2020-27133",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2020-014182",
         },
         {
            db: "NVD",
            id: "CVE-2020-27133",
         },
         {
            db: "NVD",
            id: "CVE-2020-27133",
         },
         {
            db: "CNNVD",
            id: "CNNVD-202012-855",
         },
      ],
   },
   description: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/description#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "Multiple vulnerabilities in Cisco Jabber for Windows, Jabber for MacOS, and Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system (OS) with elevated privileges or gain access to sensitive information. For more information about these vulnerabilities, see the Details section of this advisory. Cisco Jabber is a set of unified communication client solutions of Cisco (Cisco). The program provides online status display, instant messaging, voice and other functions. An authorization issue vulnerability exists in Cisco Jabber. The vulnerability is caused by the software allowing unauthenticated users to execute commands and improper handling of input to the application protocol handler. Execute arbitrary commands on the target system without the privileges of the client software's user account",
      sources: [
         {
            db: "NVD",
            id: "CVE-2020-27133",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2020-014182",
         },
         {
            db: "VULHUB",
            id: "VHN-370513",
         },
         {
            db: "VULMON",
            id: "CVE-2020-27133",
         },
      ],
      trust: 1.8,
   },
   external_ids: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            db: "NVD",
            id: "CVE-2020-27133",
            trust: 2.6,
         },
         {
            db: "JVNDB",
            id: "JVNDB-2020-014182",
            trust: 0.8,
         },
         {
            db: "CNNVD",
            id: "CNNVD-202012-855",
            trust: 0.7,
         },
         {
            db: "AUSCERT",
            id: "ESB-2020.4378",
            trust: 0.6,
         },
         {
            db: "VULHUB",
            id: "VHN-370513",
            trust: 0.1,
         },
         {
            db: "VULMON",
            id: "CVE-2020-27133",
            trust: 0.1,
         },
      ],
      sources: [
         {
            db: "VULHUB",
            id: "VHN-370513",
         },
         {
            db: "VULMON",
            id: "CVE-2020-27133",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2020-014182",
         },
         {
            db: "NVD",
            id: "CVE-2020-27133",
         },
         {
            db: "CNNVD",
            id: "CNNVD-202012-855",
         },
      ],
   },
   id: "VAR-202012-0620",
   iot: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/iot#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: true,
      sources: [
         {
            db: "VULHUB",
            id: "VHN-370513",
         },
      ],
      trust: 0.01,
   },
   last_update_date: "2023-12-18T12:35:16.357000Z",
   patch: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/patch#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            title: "cisco-sa-jabber-ZktzjpgO",
            trust: 0.8,
            url: "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-jabber-zktzjpgo",
         },
         {
            title: "Cisco: Cisco Jabber Desktop and Mobile Client Software Vulnerabilities",
            trust: 0.1,
            url: "https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-jabber-zktzjpgo",
         },
      ],
      sources: [
         {
            db: "VULMON",
            id: "CVE-2020-27133",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2020-014182",
         },
      ],
   },
   problemtype_data: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            problemtype: "CWE-269",
            trust: 1.1,
         },
         {
            problemtype: "Improper authority management (CWE-269) [NVD Evaluation ]",
            trust: 0.8,
         },
      ],
      sources: [
         {
            db: "VULHUB",
            id: "VHN-370513",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2020-014182",
         },
         {
            db: "NVD",
            id: "CVE-2020-27133",
         },
      ],
   },
   references: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/references#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            trust: 1.9,
            url: "https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-jabber-zktzjpgo",
         },
         {
            trust: 1.4,
            url: "https://nvd.nist.gov/vuln/detail/cve-2020-27133",
         },
         {
            trust: 0.6,
            url: "https://www.auscert.org.au/bulletins/esb-2020.4378/",
         },
         {
            trust: 0.1,
            url: "https://cwe.mitre.org/data/definitions/269.html",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov",
         },
      ],
      sources: [
         {
            db: "VULHUB",
            id: "VHN-370513",
         },
         {
            db: "VULMON",
            id: "CVE-2020-27133",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2020-014182",
         },
         {
            db: "NVD",
            id: "CVE-2020-27133",
         },
         {
            db: "CNNVD",
            id: "CNNVD-202012-855",
         },
      ],
   },
   sources: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/sources#",
         data: {
            "@container": "@list",
         },
      },
      data: [
         {
            db: "VULHUB",
            id: "VHN-370513",
         },
         {
            db: "VULMON",
            id: "CVE-2020-27133",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2020-014182",
         },
         {
            db: "NVD",
            id: "CVE-2020-27133",
         },
         {
            db: "CNNVD",
            id: "CNNVD-202012-855",
         },
      ],
   },
   sources_release_date: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
         data: {
            "@container": "@list",
         },
      },
      data: [
         {
            date: "2020-12-11T00:00:00",
            db: "VULHUB",
            id: "VHN-370513",
         },
         {
            date: "2020-12-11T00:00:00",
            db: "VULMON",
            id: "CVE-2020-27133",
         },
         {
            date: "2021-08-04T00:00:00",
            db: "JVNDB",
            id: "JVNDB-2020-014182",
         },
         {
            date: "2020-12-11T17:15:13.197000",
            db: "NVD",
            id: "CVE-2020-27133",
         },
         {
            date: "2020-12-10T00:00:00",
            db: "CNNVD",
            id: "CNNVD-202012-855",
         },
      ],
   },
   sources_update_date: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
         data: {
            "@container": "@list",
         },
      },
      data: [
         {
            date: "2020-12-11T00:00:00",
            db: "VULHUB",
            id: "VHN-370513",
         },
         {
            date: "2020-12-11T00:00:00",
            db: "VULMON",
            id: "CVE-2020-27133",
         },
         {
            date: "2021-08-04T07:45:00",
            db: "JVNDB",
            id: "JVNDB-2020-014182",
         },
         {
            date: "2023-11-07T03:20:49.183000",
            db: "NVD",
            id: "CVE-2020-27133",
         },
         {
            date: "2020-12-16T00:00:00",
            db: "CNNVD",
            id: "CNNVD-202012-855",
         },
      ],
   },
   threat_type: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "remote",
      sources: [
         {
            db: "CNNVD",
            id: "CNNVD-202012-855",
         },
      ],
      trust: 0.6,
   },
   title: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/title#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "plural  Cisco Jabber  Product permission management vulnerabilities",
      sources: [
         {
            db: "JVNDB",
            id: "JVNDB-2020-014182",
         },
      ],
      trust: 0.8,
   },
   type: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/type#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "authorization issue",
      sources: [
         {
            db: "CNNVD",
            id: "CNNVD-202012-855",
         },
      ],
      trust: 0.6,
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.