CVE-2020-3419

{"id": "CVE-2020-3419", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}]}, "published": "2020-11-18T19:15:12.350", "references": [{"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-auth-token-3vg57A5r", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}, {"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-auth-token-3vg57A5r", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-913"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-913"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to join a Webex session without appearing on the participant list. This vulnerability is due to improper handling of authentication tokens by a vulnerable Webex site. An attacker could exploit this vulnerability by sending crafted requests to a vulnerable Cisco Webex Meetings or Cisco Webex Meetings Server site. A successful exploit requires the attacker to have access to join a Webex meeting, including applicable meeting join links and passwords. The attacker could then exploit this vulnerability to join meetings, without appearing in the participant list, while having full access to audio, video, chat, and screen sharing capabilities."}, {"lang": "es", "value": "Una vulnerabilidad en Cisco Webex Meetings y Cisco Webex Meetings Server, podr\u00eda permitir a un atacante remoto no autenticado unirse a una sesi\u00f3n de Webex sin aparecer en la lista de participantes. Esta vulnerabilidad es debido a un manejo inapropiado de los tokens de autenticaci\u00f3n por parte de un sitio de Webex vulnerable. Un atacante podr\u00eda explotar esta vulnerabilidad mediante el env\u00edo peticiones dise\u00f1adas a un sitio vulnerable de Cisco Webex Meetings o Cisco Webex Meetings Server. Una explotaci\u00f3n con \u00e9xito requiere que el atacante tenga acceso para unirse a una reuni\u00f3n de Webex, incluyendo los enlaces aplicables para unirse a una reuni\u00f3n y contrase\u00f1as. El atacante podr\u00eda explotar esta vulnerabilidad para unirse a las reuniones, sin aparecer en la lista de participantes, mientras tiene acceso completo a las capacidades de audio, video, chat y uso compartido de pantalla"}], "lastModified": "2024-11-21T05:31:00.900", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:webex_meetings_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE22BE9B-374E-43DC-BA91-E3B9699A4C7C", "versionEndExcluding": "3.0"}, {"criteria": "cpe:2.3:a:cisco:webex_meetings_server:3.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "61D1081F-87E8-4E8B-BEBD-0F239E745586"}, {"criteria": "cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "30B55A5B-8C5E-4ECB-9C85-A8A3A3030850"}, {"criteria": "cpe:2.3:a:cisco:webex_meetings_server:3.0:maintenance_release3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "14DBEC10-0641-441C-BE15-8F72C1762DCE"}, {"criteria": "cpe:2.3:a:cisco:webex_meetings_server:4.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D6CF856-093A-4E89-A71D-50A2887C265B"}, {"criteria": "cpe:2.3:a:cisco:webex_meetings_server:4.0:maintenance_release1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B36A9043-0621-43CD-BFCD-66529F937859"}, {"criteria": "cpe:2.3:a:cisco:webex_meetings_server:4.0:maintenance_release2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8842B42E-C412-4356-9F54-DFC53B683D3E"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}