Risk | Low |
Patch available | YES |
Number of vulnerabilities | 2 |
CVE-ID | CVE-2017-12286 CVE-2017-12284 |
CWE-ID | CWE-20 |
Exploitation vector | Local |
Public exploit | N/A |
Vulnerable software Subscribe |
Cisco Jabber Client/Desktop applications / Messaging software |
Vendor | Cisco Systems, Inc |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
EUVDB-ID: #VU8886
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-12286
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
Description
The disclosed vulnerability allows a local attacker to obtain potentially sensitive information.
The vulnerability exists in the web interface of Cisco Jabber due to a lack of input and validation checks. A local attacker can issue specific commands and view all profile information for a user instead of only certain Jabber parameters that should be visible.
Successful exploitation of the vulnerability results in information disclosure.
MitigationUpdate to version 1.9.31.
Cisco Jabber: 1.9.26
External linkshttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-wmc1
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU8888
Risk: Low
CVSSv3.1: 4.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-12284
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
Description
The disclosed vulnerability allows a local attacker to obtain potentially sensitive information.
The vulnerability exists in the web interface of Cisco Jabber for Windows Client due to a lack of input and validation checks. A local attacker can issue specific commands and view profile information where only certain parameters should be visible.
Successful exploitation of the vulnerability results in information disclosure.
MitigationUpdate to version 11.8(4.52954).
Vulnerable software versionsCisco Jabber: 11.8.4
External linkshttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20171018-jab
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.