CVE-2019-1689
Cisco Webex Teams for iOS Arbitrary File Upload Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
A vulnerability in the client application for iOS of Cisco Webex Teams could allow an authenticated, remote attacker to upload arbitrary files within the scope of the iOS application. The vulnerability is due to improper input validation in the client application. An attacker could exploit this vulnerability by sending a malicious file to a targeted user and persuading the user to manually open it. An exploit could allow the attacker to overwrite sensitive application files and eventually cause a denial of service (DoS) condition by foreclosing future access to the system to the targeted user. This vulnerability is fixed in version 3.13.26920.
Una vulnerabilidad en la aplicación de cliente para iOS de Cisco Webex Teams podría permitir que un atacante remoto no autenticado suba archivos arbitrarios en el alcance de la aplicación de iOS. Esta vulnerabilidad se debe a la validación incorrecta de entradas en la aplicación de cliente. Un atacante podría explotar esta vulnerabilidad enviando un archivo malicioso a un usuario objetivo y persuadiéndolo para que lo abra de forma manual. Su explotación podría permitir que el atacante sobrescriba archivos sensibles de la aplicación y, finalmente, provoque una condición de denegación de servicio impidiendo el acceso futuro al sistema al usuario objetivo. Esto se ha solucionado en la versión 3.13.26920.
CVSS Scores
SSVC
- Decision:Track
Timeline
- 2018-12-06 CVE Reserved
- 2019-02-25 CVE Published
- 2023-11-12 EPSS Updated
- 2024-11-21 CVE Updated
- 2024-11-21 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
http://www.securityfocus.com/bid/107101 | Broken Link |
URL | Date | SRC |
---|---|---|
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-webx-ios-file | 2024-11-21 |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Cisco Search vendor "Cisco" | Webex Teams Search vendor "Cisco" for product "Webex Teams" | < 3.13.26920 Search vendor "Cisco" for product "Webex Teams" and version " < 3.13.26920" | iphone_os |
Affected
|