Vulnerability · Published Aug 26, 2020 · Assigned by cisco

CVE-2020-3440Cisco Webex Meetings Desktop App for Windows Arbitrary File Overwrite Vulnerability

Medium 6.5

In plain English

A medium-severity path traversal in Cisco Webex Meetings from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.6% (higher than 86% of all known vulnerabilities).

Severity (CVSS 3.0)6.5Medium

Exploit odds (30 days)2.6%top 14.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in Cisco Webex Meetings Desktop App for Windows could allow an unauthenticated, remote attacker to overwrite arbitrary files on an end-user system. The vulnerability is due to improper validation of URL parameters that are sent from a website to the affected application. An attacker could exploit this vulnerability by persuading a user to follow a URL to a website that is designed to submit crafted input to the affected application. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system, possibly corrupting or deleting critical system files.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco Webex Meetings	n/a

Weakness: CWE-22 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

References

20200819 Cisco Webex Meetings Desktop App for Windows Arbitrary File Overwrite Vulnerability vendor-advisory, x_refsource_CISCO