Medium severity · published Nov 18, 2020
CVE-2020-3441
Cisco Webex Meetings and Cisco Webex Meetings Server Information Disclosure Vulnerability
5.3
CVSS
1.6%
EPSS
No
On KEV
Description
A vulnerability in Cisco Webex Meetings and Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to view sensitive information from the meeting room lobby. This vulnerability is due to insufficient protection of sensitive participant information. An attacker could exploit this vulnerability by browsing the Webex roster. A successful exploit could allow the attacker to gather information about other Webex participants, such as email address and IP address, while waiting in the lobby.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CW
Cisco WebEx Meetings Server · Cisco
All versions, or not specified · source: vendor
WM
Webex Meetings · Cisco
through 40.6.11; through 40.11.3 · source: NVD
WM
Webex Meetings Server · Cisco
before 3.0; 3.0; 3.0; 4.0; 4.0; 4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-3441
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-3441
Vendor Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-infodisc-4tvQzn4
More from Cisco WebEx Meetings Server
9.1
CVE-2020-3419
Cisco Webex Meetings and Cisco Webex Meetings Server Ghost Join Vulnerability
6.5
CVE-2020-3471
Cisco Webex Meetings and Cisco Webex Meetings Server Unauthorized Audio Information Exposure Vulnerability
6.1
CVE-2021-1525
Cisco Webex Meetings and Webex Meetings Server File Redirect Vulnerability
6.1
CVE-2019-1655
Cisco Webex Meetings Server Cross-Site Scripting Vulnerability
5.4
CVE-2021-1311
Cisco Webex Meetings and Cisco Webex Meetings Server Host Key Brute Forcing Vulnerability
