CVE-2020-3345 Cisco Webex Meetings and Cisco Webex Meetings Server HTML Injection Vulnerability
Unauthenticated attackers can inject HTML into Webex Meetings pages via crafted links, enabling redirects or client-side attacks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-3345?
CVE-2020-3345 is a medium-severity cross-site scripting vulnerability in Cisco Webex Meetings, published on 16 Jul 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability in certain web pages of Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to modify a web page in the context of a browser. The vulnerability is due to improper checks on parameter values within affected pages. An attacker could exploit this vulnerability by persuading a user to follow a crafted link that is designed to pass HTML code into an affected parameter. A successful exploit could allow the attacker to alter the contents of a web page to redirect the user to potentially malicious web sites, or the attacker could leverage this vulnerability to conduct further client-side attacks.
Weakness: CWE-20
Which versions are affected by CVE-2020-3345?
It affects 2 products.
Products include Cisco Webex Meetings, Cisco Webex Meetings Server.
How do I fix CVE-2020-3345?
No fix has been published for CVE-2020-3345 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-3345 being exploited?
There is no known exploitation of CVE-2020-3345 in the wild and no public exploit code.
Other vulnerabilities in Cisco Webex Meetings
- CVE-2017-12368 Memory corruption in Cisco WebEx Recording Format and Advanced Recording Format Players
- CVE-2017-12369 Memory corruption in Cisco WebEx Recording Format and Advanced Recording Format Players
- CVE-2017-12370 Memory corruption in Cisco WebEx Recording Format and Advanced Recording Format Players
- CVE-2017-12371 Memory corruption in Cisco WebEx Recording Format and Advanced Recording Format Players
- CVE-2017-12372 Memory corruption in Cisco WebEx Recording Format and Advanced Recording Format Players
Sources
Also known as GHSA-8qwq-9r56-cp3v.