SQL injection in Cisco Systems, Inc products - CVE-2020-27134
Published: December 14, 2020
Vulnerability identifier: #VU48951
CSH Severity: Medium
CVSS v4: 7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-27134
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data within the message contents. A remote authenticated attacker can send a specially crafted XMPP messages, trick a victim to interact with a message and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
Affected software
Cisco Jabber for Windows
Cisco Jabber for MacOS
Cisco Jabber for Android and iOS
Cisco Jabber for MacOS
Cisco Jabber for Android and iOS
How to mitigate CVE-2020-27134
Install updates from vendor's website.
Cisco Jabber for Windows - addressed in versions 12.1.4, 12.5.3, 12.6.4, 12.7.3, 12.8.4, 12.9.3
Cisco Jabber for MacOS - addressed in versions 12.8.5, 12.9.4
Cisco Jabber for Android and iOS - update to 12.9.4
Cisco Jabber for MacOS - addressed in versions 12.8.5, 12.9.4
Cisco Jabber for Android and iOS - update to 12.9.4