CVE-2024-20395
First published: Wed Jul 17 2024(Updated: )
A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access to sensitive session information. This vulnerability is due to insecure transmission of requests to backend services when the app accesses embedded media, such as images. An attacker could exploit this vulnerability by sending a message with embedded media that is stored on a messaging server to a targeted user. If the attacker can observe transmitted traffic in a privileged network position, a successful exploit could allow the attacker to capture session token information from insecurely transmitted requests and possibly reuse the captured session information to take further actions as the targeted user.
Credit: ykramarz@cisco.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Cisco Webex Platform |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-20395?
CVE-2024-20395 is rated as a high-severity vulnerability due to the potential unauthorized access to sensitive session information.
How do I fix CVE-2024-20395?
To mitigate CVE-2024-20395, ensure that you are using the latest version of the Cisco Webex App with all security updates applied.
What are the potential impacts of CVE-2024-20395?
The impact of CVE-2024-20395 includes the risk of unauthorized access to sensitive media session data by adjacent attackers.
Who is affected by CVE-2024-20395?
CVE-2024-20395 affects all users of the Cisco Webex App that utilize the media retrieval functionality.
Is authentication required to exploit CVE-2024-20395?
No, CVE-2024-20395 can be exploited by unauthenticated adjacent attackers.
- agent/references
- agent/weakness
- agent/type
- agent/description
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- agent/softwarecombine
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/cisco
- canonical/cisco webex platform