Summaryinfo

A vulnerability classified as problematic was found in Cisco Webex Meetings Client on macOS. This vulnerability affects unknown code of the component mDNS Handler. The manipulation as part of DNS Query leads to information disclosure. This vulnerability was named CVE-2020-3182. The attack needs to be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Detailsinfo

A vulnerability classified as problematic has been found in Cisco Webex Meetings Client on macOS (Unified Communication Software) (the affected version unknown). This affects an unknown part of the component mDNS Handler. The manipulation as part of a DNS Query leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

A vulnerability in the multicast DNS (mDNS) protocol configuration of Cisco Webex Meetings Client for MacOS could allow an unauthenticated adjacent attacker to obtain sensitive information about the device on which the Webex client is running. The vulnerability exists because sensitive information is included in the mDNS reply. An attacker could exploit this vulnerability by doing an mDNS query for a particular service against an affected device. A successful exploit could allow the attacker to gain access to sensitive information.

The weakness was disclosed 03/04/2020 as cisco-sa-webex-info-disc-OHqg9 as confirmed advisory (Website). It is possible to read the advisory at tools.cisco.com. This vulnerability is uniquely identified as CVE-2020-3182 since 12/12/2019. The attack needs to be done within the local network. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

Upgrading eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Unified Communication Software

Vendor

• Cisco

Name

• Webex Meetings Client

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion