Detections
Analytics
Cisco Webex Meetings Desktop App Arbitrary Code Execution Vulnerability (cisco-sa-webex-vdi-qQrpBwuJ)
high Nessus Plugin ID 142503
Language:
Synopsis
The remote device is missing a vendor-supplied security patch.Description
According to its self-reported version, Cisco Webex Meetings Desktop App is prior to version 40.6.9, or is 40.8.x prior to 40.8.9 and thus, is affected by a remote code execution vulnerability. An unspecified flaw exists related to the virtualization channel interface that can allow a local attacker to execute arbitrary code with elevated privileges.Solution
Upgrade to 40.6.9, 40.8.9, or later.See Also
Plugin Details
Severity: High
ID: 142503
File Name: cisco-sa-webex-vdi-qQrpBwuJ.nasl
Version: 1.4
Type: local
Agent: windows
Family: Windows
Published: 11/6/2020
Updated: 12/1/2020
Configuration: Enable paranoid mode
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Medium
Base Score: 4.6
Temporal Score: 3.4
Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2020-3588
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:cisco:webex_meetings
Required KB Items: Settings/ParanoidReport, installed_sw/Cisco Webex Meetings
Exploit Ease: No known exploits are available
Patch Publication Date: 11/4/2020
Vulnerability Publication Date: 11/4/2020
Reference Information
CVE: CVE-2020-3588