SB2020121403 - Multiple vulnerabilities in Cisco Jabber Desktop and Mobile Client Software
Published: December 14, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 5 secuirty vulnerabilities.
1) Cross-site scripting (CVE-ID: CVE-2020-26085)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data within message contents. A remote authenticted attacker can trick the victim to open specially crafted XMPP messages and execute arbitrary HTML and script code in user's browser in context of vulnerable website, leading to arbitraty code execution with elevated privileges.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
2) Improper access control (CVE-ID: CVE-2020-27127)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper handling of input to the application protocol handlers. A remote attacker can trick a victim to click a link within a message sent by email or other messaging platform and modify the application configuration.
3) Information disclosure (CVE-ID: CVE-2020-27132)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to improper validation of message contents. A remote authenticated attacker can send specially crafted messages and gain unauthorized access to sensitive information on the system.
4) OS Command Injection (CVE-ID: CVE-2020-27133)
The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.
The vulnerability exists due to improper input validation within the application protocol handlers. A remote unauthenticated attacker can trick a victim to click a link within a message sent by email or other messaging platform and execute arbitrary OS commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
5) SQL injection (CVE-ID: CVE-2020-27134)
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data within the message contents. A remote authenticated attacker can send a specially crafted XMPP messages, trick a victim to interact with a message and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
Remediation
Install update from vendor's website.