Detections
Analytics
Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows Shared Memory Information Disclosure (cisco-sa-wda-pt-msh-6LWOcZ5)
medium Nessus Plugin ID 146594
Language:
Synopsis
The remote device is missing a vendor-supplied security patchDescription
A vulnerability in Cisco Webex Meetings Desktop App and Webex Productivity Tools for Windows could allow an authenticated, local attacker to gain access to sensitive information on an affected system. This vulnerability is due to the unsafe usage of shared memory by the affected software. An attacker with permissions to view system memory could exploit this vulnerability by running an application on the local system that is designed to read shared memory. A successful exploit could allow the attacker to retrieve sensitive information from the shared memory, including usernames, meeting information, or authentication tokens. Note: To exploit this vulnerability, an attacker must have valid credentials on a Microsoft Windows end-user system and must log in after another user has already authenticated with Webex on the same end-user system.Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Upgrade to the relevant fixed version referenced in Cisco bug IDs CSCvv02342, CSCvv21029See Also
http://www.nessus.org/u?1e77f276
Plugin Details
Severity: Medium
ID: 146594
File Name: cisco-sa-wda-pt-msh-6LWOcZ5.nasl
Version: 1.3
Type: local
Agent: windows
Family: Windows
Published: 2/19/2021
Updated: 2/25/2021
Configuration: Enable paranoid mode
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.6
CVSS v2
Risk Factor: Low
Base Score: 2.1
Temporal Score: 1.6
Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N
CVSS Score Source: CVE-2021-1372
CVSS v3
Risk Factor: Medium
Base Score: 5.5
Temporal Score: 4.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:cisco:webex_meetings
Required KB Items: Settings/ParanoidReport, installed_sw/Cisco Webex Meetings
Exploit Ease: No known exploits are available
Patch Publication Date: 2/17/2021
Vulnerability Publication Date: 2/17/2021
Reference Information
CVE: CVE-2021-1372