CVE-2020-3472
Cisco Webex Meetings User Email Address Information Disclosure Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A vulnerability in the contacts feature of Cisco Webex Meetings could allow an authenticated, remote attacker with a legitimate user account to access sensitive information. The vulnerability is due to improper access restrictions on users who are added within user contacts. An attacker on one Webex Meetings site could exploit this vulnerability by sending specially crafted requests to the Webex Meetings site. A successful exploit could allow the attacker to view the details of users on another Webex site, including user names and email addresses.
Una vulnerabilidad en la funcionalidad contacts de Cisco Webex Meetings podría permitir a un atacante remoto autenticado con una cuenta de usuario legítima acceder a información confidencial. La vulnerabilidad es debido a restricciones de acceso inapropiadas a los usuarios que se agregan a los contactos de usuarios. Un atacante en un sitio de Webex Meetings podría explotar esta vulnerabilidad mediante el envío de peticiones especialmente diseñadas al sitio de Webex Meetings. Una explotación con éxito podría permitir al atacante visualizar los detalles de los usuarios en otro sitio de Webex, incluyendo los nombres de usuario y las direcciones de correo electrónico.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2019-12-12 CVE Reserved
- 2020-08-17 CVE Published
- 2023-03-08 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
- CWE-863: Incorrect Authorization
CAPEC
References (1)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-mAkmV4qc | 2023-11-07 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Cisco Search vendor "Cisco" | Webex Meetings Online Search vendor "Cisco" for product "Webex Meetings Online" | < 40.7.0 Search vendor "Cisco" for product "Webex Meetings Online" and version " < 40.7.0" | - |
Affected
|