CVE-2022-20863

A vulnerability in the messaging interface of Cisco Webex App, formerly Webex Teams, could allow an unauthenticated, remote attacker to manipulate links or other content within the messaging interface. This vulnerability exists because the affected software does not properly handle character rendering. An attacker could exploit this vulnerability by sending messages within the application interface. A successful exploit could allow the attacker to modify the display of links or other content within the interface, potentially allowing the attacker to conduct phishing or spoofing attacks.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-app-qrtO6YC2	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:cisco:webex_teams:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2022-09-08 13:15

Updated : 2024-02-28 19:29

NVD link : CVE-2022-20863

Mitre link : CVE-2022-20863

CVE.ORG link : CVE-2022-20863

JSON object : View

Products Affected

cisco

webex_teams

CWE

NVD-CWE-Other CWE-450

Multiple Interpretations of UI Input

{"id": "CVE-2022-20863", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2022-09-08T13:15:08.930", "references": [{"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-app-qrtO6YC2", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-450"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the messaging interface of Cisco Webex App, formerly Webex Teams, could allow an unauthenticated, remote attacker to manipulate links or other content within the messaging interface. This vulnerability exists because the affected software does not properly handle character rendering. An attacker could exploit this vulnerability by sending messages within the application interface. A successful exploit could allow the attacker to modify the display of links or other content within the interface, potentially allowing the attacker to conduct phishing or spoofing attacks."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz de mensajer\u00eda de la aplicaci\u00f3n Cisco Webex, anteriormente Webex Teams, podr\u00eda permitir a un atacante remoto no autenticado manipular enlaces u otro contenido dentro de la interfaz de mensajer\u00eda. Esta vulnerabilidad se presenta porque el software afectado no maneja apropiadamente la representaci\u00f3n de caracteres. Un atacante podr\u00eda explotar esta vulnerabilidad mediante el env\u00edo de mensajes dentro de la interfaz de la aplicaci\u00f3n. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante modificar la visualizaci\u00f3n de enlaces u otro contenido dentro de la interfaz, lo que podr\u00eda permitirle conducir ataques de phishing o suplantaci\u00f3n de identidad"}], "lastModified": "2023-11-07T03:43:09.390", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:webex_teams:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A333C399-691C-45CF-B8C1-B1E9C3DED212", "versionEndExcluding": "42.7"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}