Vulnerability · Published Feb 19, 2020 · Assigned by cisco

CVE-2020-3160Cisco Meeting Server Extensible Messaging and Presence Protocol Denial of Service Vulnerability

Medium 5.3

In plain English

A medium-severity improper input validation in Cisco Meeting Server from Cisco. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities).

Severity (CVSS 3.0)5.3Medium

Exploit odds (30 days)1.2%top 30.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) feature of Cisco Meeting Server software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition for users of XMPP conferencing applications. Other applications and processes are unaffected. The vulnerability is due to improper input validation of XMPP packets. An attacker could exploit this vulnerability by sending crafted XMPP packets to an affected device. An exploit could allow the attacker to cause process crashes and a DoS condition for XMPP conferencing applications.

Affected products (as reported)

Vendor	Product	Versions
Cisco	Cisco Meeting Server	unspecified – before n/a

Weakness: CWE-20 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

20200219 Cisco Meeting Server Extensible Messaging and Presence Protocol Denial of Service Vulnerability vendor-advisory, x_refsource_CISCO