Lucene search

[email protected]CVE-2020-3498

HistorySep 04, 2020 - 3:15 a.m.

CVE-2020-3498

2020-09-0403:15:10

CWE-200

CWE-20

[email protected]

web.nvd.nist.gov

cve-2020-3498

cisco jabber

vulnerability

remote attack

sensitive information

nvd

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

7.5 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

51.0%

JSON

A vulnerability in Cisco Jabber software could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted messages to a targeted system. A successful exploit could allow the attacker to cause the application to return sensitive authentication information to another system, possibly for use in further attacks.

Affected configurations

NVD

Node

ciscojabberRange12.1–12.1.3windows

ciscojabberRange12.5–12.5.2windows

ciscojabberRange12.6–12.6.3windows

ciscojabberRange12.7–12.7.2windows

ciscojabberRange12.8–12.8.3windows

ciscojabberRange12.9–12.9.1windows

CPENameOperatorVersion
cisco:jabbercisco jabberlt12.1.3
cisco:jabbercisco jabberlt12.5.2
cisco:jabbercisco jabberlt12.6.3
cisco:jabbercisco jabberlt12.7.2
cisco:jabbercisco jabberlt12.8.3
cisco:jabbercisco jabberlt12.9.1

CPE	Name	Operator	Version
cisco:jabber	cisco jabber	lt	12.1.3
cisco:jabber	cisco jabber	lt	12.5.2
cisco:jabber	cisco jabber	lt	12.6.3
cisco:jabber	cisco jabber	lt	12.7.2
cisco:jabber	cisco jabber	lt	12.8.3
cisco:jabber	cisco jabber	lt	12.9.1

CNA Affected

[
  {
    "product": "Cisco Jabber ",
    "vendor": "Cisco",
    "versions": [
      {
        "status": "affected",
        "version": "n/a"
      }
    ]
  }
]