Vulnerability · Published Apr 13, 2020 · Assigned by cisco
CVE-2020-3126Cisco Webex Meetings Multimedia Viewer Vulnerability
Low 3.0
In plain English
A low-severity improper access control in Cisco Webex Meetings Multimedia Viewer from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).
Official description
vulnerability within the Multimedia Viewer feature of Cisco Webex Meetings could allow an authenticated, remote attacker to bypass security protections. The vulnerability is due to missing security warning dialog boxes when a room host views shared multimedia files. An authenticated, remote attacker could exploit this vulnerability by using the host role to share files within the Multimedia sharing feature and convincing a former room host to view that file. A warning dialog normally appears cautioning users before the file is displayed; however, the former host would not see that warning dialog, and any shared multimedia would be rendered within the user's browser. The attacker could leverage this behavior to conduct additional attacks by including malicious files within a targeted room host's browser window.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Cisco | Cisco Webex Meetings Multimedia Viewer | T39.3 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N
References
- 20200413 Cisco Webex Meetings Multimedia Viewer Vulnerability vendor-advisory, x_refsource_CISCO