Information disclosure in Cisco Webex Meetings Desktop App and Cisco WebEx Meetings Server - CVE-2020-3502
Published: August 6, 2020
Vulnerability identifier: #VU34088
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-3502
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in the user interface. A remote authenticated attacker can trick a victim to follow a specially crafted URL and gain unauthorized access to sensitive information on the system.
Affected software
Cisco Webex Meetings Desktop App
Cisco WebEx Meetings Server
Cisco WebEx Meetings Server
How to mitigate CVE-2020-3502
Install updates from vendor's website.
Cisco Webex Meetings Desktop App - addressed in versions 39.5.24, 40.4.6, 40.6
Cisco WebEx Meetings Server - addressed in versions 3.0MR3 Patch 3, 4.0MR3 Patch 2
Cisco WebEx Meetings Server - addressed in versions 3.0MR3 Patch 3, 4.0MR3 Patch 2