// For flags

CVE-2019-1855

Cisco Jabber for Windows DLL Preloading Vulnerability

Severity Score

7.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability in the loading mechanism of specific dynamic link libraries in Cisco Jabber for Windows could allow an authenticated, local attacker to perform a DLL preloading attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. The vulnerability is due to insufficient validation of the resources loaded by the application at run time. An attacker could exploit this vulnerability by crafting a malicious DLL file and placing it in a specific location on the targeted system. The malicious DLL file would execute when the Jabber application launches. A successful exploit could allow the attacker to execute arbitrary code on the target machine with the privileges of another user's account.

Una vulnerabilidad en el mecanismo de carga de bibliotecas de enlace dinámico específicas en Cisco Jabber para Windows podría permitir a un atacante local autenticado realizar un ataque de precarga de DLL. Para aprovechar esta vulnerabilidad, el atacante necesitaría tener credenciales válidas en el sistema de Windows. La vulnerabilidad se debe a una validación insuficiente de los recursos cargados por la aplicación en el tiempo de ejecución. Un atacante podría aprovechar esta vulnerabilidad creando un archivo DLL malicioso y ubicándolo en una ubicación específica del sistema de destino. El archivo DLL malicioso se ejecutaría cuando se inicie la aplicación Jabber. Una explotación con éxito podría permitir al atacante ejecutar código arbitrario en la máquina de destino con los privilegios de la cuenta de otro usuario.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2018-12-06 CVE Reserved
  • 2019-07-04 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-09-17 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-264: Permissions, Privileges, and Access Controls
  • CWE-427: Uncontrolled Search Path Element
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Jabber
Search vendor "Cisco" for product "Jabber"
 < 12.6\(2\)
Search vendor "Cisco" for product "Jabber" and version " < 12.6\(2\)"
windows
Affected