Cisco Webex Meetings Desktop App Information Disclosure Vulnerabilities

Vulnerability

The user interface of Cisco Webex Meetings Desktop App contains multiple input validation vulnerabilities that allow an authenticated, remote attacker to obtain restricted information from other Webex users [1]. The flaw resides in how the application processes parameters returned from a web site, specifically path parameters that are not properly validated. Affected versions include all releases prior to 39.5.24, 40.4.6, and 40.6 [1]. These vulnerabilities are not dependent on any specific configuration, as they are present in the application's default handling of web responses.

Exploitation

An attacker must have a valid Webex account to exploit these vulnerabilities [1]. The attack vector involves persuading a targeted user to follow a URL that returns malicious path parameters to the affected software [1]. The attacker does not need direct network access to the victim's machine; rather, the exploitation relies on the victim clicking a crafted link while authenticated to Webex. No write access or interaction beyond the victim clicking the link is required [1].

Impact

Successful exploitation allows the attacker to obtain restricted information from other Webex users [1]. This is an information disclosure vulnerability that compromises confidentiality (C) of user data, while integrity (I) and availability (A) are not directly affected. The attacker does not gain elevated privileges on the system itself but can access sensitive data belonging to other users on the same Webex platform [1].

Mitigation

Cisco released software updates to address these vulnerabilities in versions 39.5.24, 40.4.6, and 40.6 [1]. There are no workarounds available [1]. Users should upgrade to a fixed release as soon as possible. This vulnerability is not known to be listed in the CISA Known Exploited Vulnerabilities catalog (KEV) as of the publication date [1].