CVE-2020-3430 Cisco Jabber for Windows Protocol Handler Command Injection Vulnerability

High 8.8 Published 4 Sep 2020 Updated 13 Nov 2024

Remote attackers can execute arbitrary commands on Windows systems by tricking users into clicking malicious links in Cisco Jabber.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2020-3430?

CVE-2020-3430 is a high-severity command injection vulnerability in Cisco Jabber, published on 4 Sep 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A vulnerability in the application protocol handling features of Cisco Jabber for Windows could allow an unauthenticated, remote attacker to execute arbitrary commands. The vulnerability is due to improper handling of input to the application protocol handlers. An attacker could exploit this vulnerability by convincing a user to click a link within a message sent by email or other messaging platform. A successful exploit could allow the attacker to execute arbitrary commands on a targeted system with the privileges of the user account that is running the Cisco Jabber client software.

Weakness: CWE-78

Which versions are affected by CVE-2020-3430?

It affects 1 product.

Products include Cisco Jabber.

How do I fix CVE-2020-3430?

No fix has been published for CVE-2020-3430 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2020-3430 being exploited?

There is no known exploitation of CVE-2020-3430 in the wild and no public exploit code.

Sources

Also known as GHSA-hqr6-633p-3x2j.