Cisco Webex Meeting Multimedia Viewer Media File access control

Summaryinfo

A vulnerability classified as critical has been found in Cisco Webex Meeting. Affected is an unknown function of the component Multimedia Viewer. Performing a manipulation as part of Media File results in access control. This vulnerability is known as CVE-2020-3126. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability, which was classified as critical, was found in Cisco Webex Meeting (Unified Communication Software) (version now known). This affects some unknown processing of the component Multimedia Viewer. The manipulation as part of a Media File leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

vulnerability within the Multimedia Viewer feature of Cisco Webex Meetings could allow an authenticated, remote attacker to bypass security protections. The vulnerability is due to missing security warning dialog boxes when a room host views shared multimedia files. An authenticated, remote attacker could exploit this vulnerability by using the host role to share files within the Multimedia sharing feature and convincing a former room host to view that file. A warning dialog normally appears cautioning users before the file is displayed; however, the former host would not see that warning dialog, and any shared multimedia would be rendered within the user's browser. The attacker could leverage this behavior to conduct additional attacks by including malicious files within a targeted room host's browser window.

The weakness was published 04/13/2020 (Website). It is possible to read the advisory at quickview.cloudapps.cisco.com. This vulnerability is uniquely identified as CVE-2020-3126 since 12/12/2019. The exploitability is told to be difficult. It is possible to initiate the attack remotely. Required for exploitation is a authentication. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 04/14/2020). The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Unified Communication Software

Vendor

• Cisco

Name

• Webex Meeting

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion