CVE-2019-1939: cisco cisco webex teams Injection

Vulnerability summary

CVE-2019-1939 is a high (CVSS 9.3) Injection vulnerability in cisco cisco webex teams. EPSS estimates a 4.31% chance of exploitation in the next 30 days, higher than 91% of scored vulnerabilities.

Timeline

1. 05-09-2019
   PublishedVulnerability first disclosed.
2. 20-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the Cisco Webex Teams client for Windows could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected system. This vulnerability is due to improper restrictions on software logging features used by the application on Windows operating systems. An attacker could exploit this vulnerability by convincing a targeted user to visit a website designed to submit malicious input to the affected application. A successful exploit could allow the attacker to cause the application to modify files and execute arbitrary commands on the system with the privileges of the targeted user.

• CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.