Vulnerability Details : CVE-2019-1689
Potential exploit
A vulnerability in the client application for iOS of Cisco Webex Teams could allow an authenticated, remote attacker to upload arbitrary files within the scope of the iOS application. The vulnerability is due to improper input validation in the client application. An attacker could exploit this vulnerability by sending a malicious file to a targeted user and persuading the user to manually open it. An exploit could allow the attacker to overwrite sensitive application files and eventually cause a denial of service (DoS) condition by foreclosing future access to the system to the targeted user. This vulnerability is fixed in version 3.13.26920.
Vulnerability category: Input validationDenial of service
Products affected by CVE-2019-1689
- cpe:2.3:a:cisco:webex_teams:*:*:*:*:*:*:iphone_os:*
Exploit prediction scoring system (EPSS) score for CVE-2019-1689
0.36%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 55 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-1689
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.9
|
MEDIUM | AV:N/AC:M/Au:S/C:N/I:P/A:P |
6.8
|
4.9
|
NIST | |
|
7.3
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H |
2.1
|
5.2
|
Cisco Systems, Inc. | |
|
7.3
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H |
2.1
|
5.2
|
NIST |
CWE ids for CVE-2019-1689
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by:
- nvd@nist.gov (Primary)
- ykramarz@cisco.com (Secondary)
References for CVE-2019-1689
-
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190220-webx-ios-file
Cisco Webex Teams for iOS Arbitrary File Upload VulnerabilityExploit;Vendor Advisory
-
http://www.securityfocus.com/bid/107101
Cisco Webex Teams for iOS CVE-2019-1689 Arbitrary File Upload VulnerabilityBroken Link;Third Party Advisory;VDB Entry
Jump to