CVE-2019-12645 - Cisco Jabber Client Framework for Mac Code Execution Vulnerability

Back Back to CVE browser

HIGH

Cisco Jabber Client Framework for Mac Code Execution Vulnerability

Published Sep 5, 2019

7.8

HIGH

CVSS 3.1

EPSS 0.31%

Description

A vulnerability in Cisco Jabber Client Framework (JCF) for Mac Software, installed as part of the Cisco Jabber for Mac client, could allow an authenticated, local attacker to execute arbitrary code on an affected device The vulnerability is due to improper file level permissions on an affected device when it is running Cisco JCF for Mac Software. An attacker could exploit this vulnerability by authenticating to the affected device and executing arbitrary code or potentially modifying certain configuration files. A successful exploit could allow the attacker to execute arbitrary code or modify certain configuration files on the device using the privileges of the installed Cisco JCF for Mac Software.

Affected products

Vendor Cisco Product Cisco Jabber for Mac Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <12.6(1)

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Cisco

Cisco Jabber for Mac

n/a

Version	Status	Constraints
unspecified	affected	<12.6(1)

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-20

Improper Input Validation

CWE-732

Incorrect Permission Assignment

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4236
Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190904-jcf-codex
vendor-advisoryx_refsource_CISCOVendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-4236		Advisory
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190904-jcf-codex		vendor-advisoryx_refsource_CISCOVendor Advisory