CVE-2024-20395
MediumWhat is CVE-2024-20395?
A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access to sensitive session information. This vulnerability is due to insecure transmission of requests to backend services when the app accesses embedded media, such as images. An attacker could exploit this vulnerability by sending a message with embedded media that is stored on a messaging server to a targeted user. If the attacker can observe transmitted traffic in a privileged network position, a successful exploit could allow the attacker to capture session token information from insecurely transmitted requests and possibly reuse the captured session information to take further actions as the targeted user.
CVSS Vector Breakdown
CVSS 3.1Exploitable from an adjacent network (e.g. same LAN, Wi-Fi segment, Bluetooth).
Exploit requires specific conditions, timing, or configuration to succeed.
No authentication required. Any anonymous user can exploit this vulnerability.
Victim must take an action (e.g. click a link, open a file) for the exploit to succeed.
Exploiting the vulnerability only affects the vulnerable component itself.
Complete loss of confidentiality. All data on the component may be exposed.
Complete loss of integrity. Attacker can modify any file or data on the component.
No availability impact. Service remains fully operational.
Known Affected Devices
FAQ
CVE-2024-20395 has a CVSS score of 6.4/10, rated as Medium. Review the affected products list and apply vendor patches.
CVSS (Common Vulnerability Scoring System) rates vulnerability severity from 0.0 to 10.0. CVE-2024-20395 scores 6.4/10 (Medium). Scores 9.0–10.0 are Critical, 7.0–8.9 are High, 4.0–6.9 are Medium, and below 4.0 are Low.
The list of devices confirmed to be affected by CVE-2024-20395 is shown in the "Affected Devices" section above. Check your firmware version against the vendor security advisory and apply the latest patch.
Apply the latest firmware or software update from the vendor. Check the References section above for official advisories and patch notes. If no patch is available, consider disabling the affected feature or isolating the device from untrusted networks.