CVE-2020-3131 Cisco Webex Teams Adaptive Cards Denial of Service Vulnerability

Medium 6.5 Published 26 Jan 2020 Updated 15 Nov 2024

An authenticated attacker can crash the Cisco Webex Teams Windows client by sending malicious adaptive cards, causing a denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-3131?

CVE-2020-3131 is a medium-severity denial of service vulnerability in Cisco Webex Teams, published on 26 Jan 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability in the Cisco Webex Teams client for Windows could allow an authenticated, remote attacker to cause the client to crash, resulting in a denial of service (DoS) condition. The attacker needs a valid developer account to exploit this vulnerability. The vulnerability is due to insufficient input validation when processing received adaptive cards. The attacker could exploit this vulnerability by sending an adaptive card with malicious content to an existing user of the Cisco Webex Teams client for Windows. A successful exploit could allow the attacker to cause the targeted user's client to crash continuously. This vulnerability was introduced in Cisco Webex Teams client for Windows Release 3.0.13131.

Weakness: CWE-400

Which versions are affected by CVE-2020-3131?

It affects 1 product.

Products include Cisco Webex Teams.

How do I fix CVE-2020-3131?

No fix has been published for CVE-2020-3131 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2020-3131 being exploited?

There is no known exploitation of CVE-2020-3131 in the wild and no public exploit code.

Sources

Also known as GHSA-whhw-94p5-5pc4.