CVE-2020-3498 Cisco Jabber for Windows Information Disclosure Vulnerability
An authenticated remote attacker can exploit improper message validation in Cisco Jabber to leak sensitive authentication information to another system.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-3498?
CVE-2020-3498 is a medium-severity vulnerability in Cisco Jabber, published on 4 Sep 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability in Cisco Jabber software could allow an authenticated, remote attacker to gain access to sensitive information. The vulnerability is due to improper validation of message contents. An attacker could exploit this vulnerability by sending specially crafted messages to a targeted system. A successful exploit could allow the attacker to cause the application to return sensitive authentication information to another system, possibly for use in further attacks.
Which versions are affected by CVE-2020-3498?
It affects 1 product.
Products include Cisco Jabber.
How do I fix CVE-2020-3498?
No fix has been published for CVE-2020-3498 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-3498 being exploited?
There is no known exploitation of CVE-2020-3498 in the wild and no public exploit code.
Other vulnerabilities in Cisco Jabber
- CVE-2021-1411 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities
- CVE-2021-1417 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities
- CVE-2021-1418 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities
- CVE-2021-1469 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities
- CVE-2021-1471 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities
Sources
Also known as GHSA-629q-m7cg-wch9.