Information disclosure in Cisco Jabber - CVE-2017-12284
Published: October 19, 2017
Vulnerability identifier: #VU8888
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-12284
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The disclosed vulnerability allows a local attacker to obtain potentially sensitive information.
The vulnerability exists in the web interface of Cisco Jabber for Windows Client due to a lack of input and validation checks. A local attacker can issue specific commands and view profile information where only certain parameters should be visible.
Successful exploitation of the vulnerability results in information disclosure.
Affected software
Cisco Jabber
How to mitigate CVE-2017-12284
Update to version 11.8(4.52954).