A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access to sensitive session information. This vulnerability is due to insecure transmission of requests to backend services when the app accesses embedded media, such as images. An attacker could exploit this vulnerability by sending a message with embedded media that is stored on a messaging server to a targeted user. If the attacker can observe transmitted traffic in a privileged network position, a successful exploit could allow the attacker to capture session token information from insecurely transmitted requests and possibly reuse the captured session information to take further actions as the targeted user.
CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:NCisco Webex Teams
APPCisco3.0.13464.03.0.13538.03.0.13588.03.0.14154.03.0.14234.03.0.14375.03.0.14741.03.0.14866.03.0.15015.03.0.15036.03.0.15092.03.0.15131.03.0.15164.03.0.15221.03.0.15333.0+ 79 wiΔcej
Related vulnerabilities
A vulnerability in the custom URL parser of Cisco Webex App could allow an unauthenticated, remote attacker to...
A vulnerability in Cisco Webex Network Recording Player for Windows and MacOS and Cisco Webex Player for Windo...
A vulnerability in the loading mechanism of specific DLLs in the Cisco Webex Teams client for Windows could al...
A vulnerability in the SSL implementation of the Cisco Intelligent Proximity solution could allow an unauthent...
A vulnerability in the Cisco Webex Teams client for Windows could allow an unauthenticated, remote attacker to...