SB2021061718 - Multiple vulnerabilities in Cisco Jabber Desktop and Mobile Client
Published: June 17, 2021
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 vulnerabilities.
1) Insufficiently protected credentials (CVE-ID: CVE-2021-1569)
CWE-ID: CWE-522 - Insufficiently Protected Credentials
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack or gain access to sensitive information.
The vulnerability exists due to improper input validation when processing messages. A remote authenticated attacker can send a specially crafted Extensible Messaging and Presence Protocol (XMPP) message to the affected application and gain access to return sensitive authentication information to another system, which the attacker could use in further attacks.
2) Resource management error (CVE-ID: CVE-2021-1570)
CWE-ID: CWE-399 - Resource Management Errors
CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to improper validation of message content. A remote authenticated attacker can send specially crafted message to the application and perform a denial of service (DoS) attack.
Remediation
Install update from vendor's website.