CVE-2017-12286 — MEDIUM (5.5)

Vulnerability Description

A vulnerability in the web interface of Cisco Jabber could allow an authenticated, local attacker to retrieve user profile information from the affected software, which could lead to the disclosure of confidential information. The vulnerability is due to a lack of input and validation checks in the affected software. An attacker could exploit this vulnerability by authenticating locally to an affected system and then issuing specific commands to the affected software. A successful exploit could allow the attacker to view all profile information for a user instead of only certain Jabber parameters that should be visible. This vulnerability affects all releases of Cisco Jabber prior to Release 1.9.31. Cisco Bug IDs: CSCve52418.

CVSS Score

5.5

MEDIUM

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Cisco	Jabber	1.9.30
Cisco	Webex Meeting Center	1.9.26

Related Weaknesses (CWE)

CWE-20

References

http://www.securityfocus.com/bid/101515Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039625Third Party AdvisoryVDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2Vendor Advisory
http://www.securityfocus.com/bid/101515Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039625Third Party AdvisoryVDB Entry
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-2Vendor Advisory

FAQ

What is CVE-2017-12286?

CVE-2017-12286 is a vulnerability with a CVSS score of 5.5 (MEDIUM). A vulnerability in the web interface of Cisco Jabber could allow an authenticated, local attacker to retrieve user profile information from the affected software, which could lead to the disclosure of...

How severe is CVE-2017-12286?

CVE-2017-12286 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-12286?

Check the references section above for vendor advisories and patch information. Affected products include: Cisco Jabber, Cisco Webex Meeting Center.