// For flags

CVE-2020-3342

Cisco Webex Meetings Desktop App for Mac Update Feature Code Execution Vulnerability

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability in the software update feature of Cisco Webex Meetings Desktop App for Mac could allow an unauthenticated, remote attacker to execute arbitrary code on an affected system. The vulnerability is due to improper validation of cryptographic protections on files that are downloaded by the application as part of a software update. An attacker could exploit this vulnerability by persuading a user to go to a website that returns files to the client that are similar to files that are returned from a valid Webex website. The client may fail to properly validate the cryptographic protections of the provided files before executing them as part of an update. A successful exploit could allow the attacker to execute arbitrary code on the affected system with the privileges of the user.

Una vulnerabilidad en la funcionalidad software update de Cisco Webex Meetings Desktop App para Mac, podría permitir a un atacante remoto no autenticado ejecutar código arbitrario sobre un sistema afectado. La vulnerabilidad es debido a una comprobación inapropiada de las protecciones criptográficas en los archivos que son descargados por la aplicación como parte de una actualización de software. Un atacante podría explotar esta vulnerabilidad al persuadir a un usuario para que vaya a un sitio web que devuelva archivos al cliente que son similares a los archivos que son devueltos de un sitio web válido de Webex. El cliente puede presentar un fallo al comprobar apropiadamente las protecciones criptográficas de los archivos proporcionados antes de ejecutarlos como parte de una actualización. Una explotación con éxito podría permitir a un atacante ejecutar código arbitrario sobre el sistema afectado con los privilegios del usuario

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Medium
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-12-12 CVE Reserved
  • 2020-06-18 CVE Published
  • 2024-07-27 EPSS Updated
  • 2024-09-17 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-295: Improper Certificate Validation
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cisco
Search vendor "Cisco"
 Webex Meetings
Search vendor "Cisco" for product "Webex Meetings"
 < 39.5.11
Search vendor "Cisco" for product "Webex Meetings" and version " < 39.5.11"
desktop, mac_os
Affected