Exposure of Resource to Wrong Sphere in Cisco Jabber



Published: 2022-10-06
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2022-20917
CWE-ID CWE-668
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
Cisco Jabber for Windows
Client/Desktop applications / Messaging software

Cisco Jabber for MacOS
Client/Desktop applications / Messaging software

Cisco Jabber for Android and iOS
Client/Desktop applications / Messaging software

Cisco Jabber for Android MAM
Client/Desktop applications / Messaging software

Cisco Jabber for iOS MAM
Client/Desktop applications / Messaging software

Vendor Cisco Systems, Inc

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Exposure of Resource to Wrong Sphere

EUVDB-ID: #VU67953

Risk: Low

CVSSv3.1:

CVE-ID: CVE-2022-20917

CWE-ID: CWE-668 - Exposure of resource to wrong sphere

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the system.

The vulnerability exists due to the improper handling of nested Extensible Messaging and Presence Protocol (XMPP) messages. A remote user can send specially crafted XMPP messages and cause the Jabber client application to perform unsafe actions.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Cisco Jabber for Windows: 12.5 - 14.1

Cisco Jabber for MacOS: 12.7 - 14.1

Cisco Jabber for Android and iOS: 14.1

Cisco Jabber for Android MAM: 14.1

Cisco Jabber for iOS MAM: 14.1


CPE2.3 External links

http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-xmpp-Ne9SCM

Q & A

Can this vulnerability be exploited remotely?

Is there known malware, which exploits this vulnerability?



###SIDEBAR###