CVE-2022-20763: cisco cisco webex meetings Deserialization of Untrusted Data

Vulnerability summary

CVE-2022-20763 is a high (CVSS 8.8) Deserialization of Untrusted Data vulnerability in cisco cisco webex meetings. EPSS estimates a 0.90% chance of exploitation in the next 30 days, higher than 58.9% of scored vulnerabilities.

Timeline

1. 06-04-2022
   PublishedVulnerability first disclosed.
2. 06-11-2024
   Last modifiedVulnerability information updated.

Description

A vulnerability in the login authorization components of Cisco Webex Meetings could allow an authenticated, remote attacker to inject arbitrary Java code. This vulnerability is due to improper deserialization of Java code within login requests. An attacker could exploit this vulnerability by sending malicious login requests to the Cisco Webex Meetings service. A successful exploit could allow the attacker to inject arbitrary Java code and take arbitrary actions within the Cisco Webex Meetings application.

• CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.