Sign-up

ID

VAR-201902-0458


CVE

CVE-2019-1674


TITLE

Cisco Webex Meetings Desktop Application and Cisco Webex Productivity Tools In OS Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2019-002555

DESCRIPTION

A vulnerability in the update service of Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools for Windows could allow an authenticated, local attacker to execute arbitrary commands as a privileged user. The vulnerability is due to insufficient validation of user-supplied parameters. An attacker could exploit this vulnerability by invoking the update service command with a crafted argument. An exploit could allow the attacker to run arbitrary commands with SYSTEM user privileges. While the CVSS Attack Vector metric denotes the requirement for an attacker to have local access, administrators should be aware that in Active Directory deployments, the vulnerability could be exploited remotely by leveraging the operating system remote management tools. This vulnerability is fixed in Cisco Webex Meetings Desktop App Release 33.6.6 and 33.9.1 releases. This vulnerability is fixed in Cisco Webex Productivity Tools Release 33.0.7. This issue being tracked by Cisco Bug ID CSCvn55874

Trust: 2.07

sources: NVD: CVE-2019-1674 // JVNDB: JVNDB-2019-002555 // BID: 107184 // VULHUB: VHN-148916 // VULMON: CVE-2019-1674

AFFECTED PRODUCTS

vendor:ciscomodel:webex meetings onlinescope:eqversion:t33.6.1

Trust: 1.0

vendor:ciscomodel:webex meetingsscope:ltversion:33.6.6

Trust: 1.0

vendor:ciscomodel:webex meetings onlinescope:eqversion:t33.6.2

Trust: 1.0

vendor:ciscomodel:webex productivity toolsscope:gteversion:32.6.0

Trust: 1.0

vendor:ciscomodel:webex meetings onlinescope:eqversion:t33.6.0

Trust: 1.0

vendor:ciscomodel:webex meetings onlinescope:eqversion:t33.0.5

Trust: 1.0

vendor:ciscomodel:webex productivity toolsscope:ltversion:33.0.7

Trust: 1.0

vendor:ciscomodel:webex meetingsscope: - version: -

Trust: 0.8

vendor:ciscomodel:webex meetings onlinescope: - version: -

Trust: 0.8

vendor:ciscomodel:webex productivity toolsscope: - version: -

Trust: 0.8

vendor:ciscomodel:webex productivity toolsscope:eqversion:33.0.5

Trust: 0.3

vendor:ciscomodel:webex productivity toolsscope:eqversion:32.6

Trust: 0.3

vendor:ciscomodel:webex meetings online t33.6.2scope: - version: -

Trust: 0.3

vendor:ciscomodel:webex meetings online t33.6.1scope: - version: -

Trust: 0.3

vendor:ciscomodel:webex meetings online t33.6.0scope: - version: -

Trust: 0.3

vendor:ciscomodel:webex meetings online t33.0.5scope: - version: -

Trust: 0.3

vendor:ciscomodel:webex meetings desktop appscope:eqversion:0

Trust: 0.3

vendor:ciscomodel:webex productivity toolsscope:neversion:33.0.7

Trust: 0.3

vendor:ciscomodel:webex meetings desktop appscope:neversion:33.6.6

Trust: 0.3

sources: BID: 107184 // JVNDB: JVNDB-2019-002555 // NVD: CVE-2019-1674

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-1674
value: HIGH

Trust: 1.0

ykramarz@cisco.com: CVE-2019-1674
value: HIGH

Trust: 1.0

NVD: CVE-2019-1674
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201902-983
value: HIGH

Trust: 0.6

VULHUB: VHN-148916
value: HIGH

Trust: 0.1

VULMON: CVE-2019-1674
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2019-1674
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-148916
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-1674
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.0

Trust: 1.8

ykramarz@cisco.com: CVE-2019-1674
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 1.0

sources: VULHUB: VHN-148916 // VULMON: CVE-2019-1674 // JVNDB: JVNDB-2019-002555 // CNNVD: CNNVD-201902-983 // NVD: CVE-2019-1674 // NVD: CVE-2019-1674

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.9

sources: VULHUB: VHN-148916 // JVNDB: JVNDB-2019-002555 // NVD: CVE-2019-1674

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201902-983

TYPE

operating system commend injection

Trust: 0.6

sources: CNNVD: CNNVD-201902-983

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-002555

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-148916 // 
            
            
            
            VULMON: CVE-2019-1674

PATCH
title:cisco-sa-20190227-wmda-cmdinjurl:https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190227-wmda-cmdinj
Trust: 0.8
title:Cisco Webex Meetings Desktop App  and Cisco Webex Productivity Tools Fixes for operating system command injection vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=89690
Trust: 0.6
title:The Registerurl:https://www.theregister.co.uk/2019/03/02/security_roundup/
Trust: 0.2
title:Cisco: Cisco Webex Meetings Desktop App and Cisco Webex Productivity Tools Update Service Command Injection Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=cisco_security_advisories_and_alerts_ciscoproducts&qid=cisco-sa-20190227-wmda-cmdinj
Trust: 0.1
title:BleepingComputerurl:https://www.bleepingcomputer.com/news/security/cisco-fixes-critical-rce-vulnerability-in-rv110w-rv130w-and-rv215w-routers/
Trust: 0.1
title:Threatposturl:https://threatpost.com/cisco-patches-high-severity-webex-vulnerability-for-third-time/142243/
Trust: 0.1
title:BleepingComputerurl:https://www.bleepingcomputer.com/news/security/new-elevation-of-privilege-vulnerability-found-in-cisco-webex-meetings/
Trust: 0.1
sources:
            
            
            VULMON: CVE-2019-1674 // 
            
            
            
            JVNDB: JVNDB-2019-002555 // 
            
            
            
            CNNVD: CNNVD-201902-983

EXTERNAL IDS
db:NVDid:CVE-2019-1674
Trust: 2.6
db:BIDid:107184
Trust: 2.1
db:EXPLOIT-DBid:46479
Trust: 1.8
db:JVNDBid:JVNDB-2019-002555
Trust: 0.8
db:PACKETSTORMid:151914
Trust: 0.7
db:CNNVDid:CNNVD-201902-983
Trust: 0.7
db:NSFOCUSid:42826
Trust: 0.6
db:AUSCERTid:ESB-2019.0621
Trust: 0.6
db:VULHUBid:VHN-148916
Trust: 0.1
db:VULMONid:CVE-2019-1674
Trust: 0.1
sources:
            
            
            VULHUB: VHN-148916 // 
            
            
            
            VULMON: CVE-2019-1674 // 
            
            
            
            BID: 107184 // 
            
            
            
            JVNDB: JVNDB-2019-002555 // 
            
            
            
            CNNVD: CNNVD-201902-983 // 
            
            
            
            NVD: CVE-2019-1674

REFERENCES
url:https://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20190227-wmda-cmdinj
Trust: 2.8
url:http://www.securityfocus.com/bid/107184
Trust: 2.4
url:https://www.exploit-db.com/exploits/46479/
Trust: 1.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-1674
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-1674
Trust: 0.8
url:https://www.exploit-db.com/exploits/46479
Trust: 0.7
url:https://packetstormsecurity.com/files/151914/cisco-webex-meetings-privilege-escalation.html
Trust: 0.6
url:http://www.nsfocus.net/vulndb/42826
Trust: 0.6
url:https://www.auscert.org.au/bulletins/76234
Trust: 0.6
url:http://www.cisco.com/
Trust: 0.3
url:https://www.secureauth.com/labs/advisories/cisco-webex-meetings-elevation-privilege-vulnerability-version-2
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/78.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://threatpost.com/cisco-patches-high-severity-webex-vulnerability-for-third-time/142243/
Trust: 0.1
sources:
            
            
            VULHUB: VHN-148916 // 
            
            
            
            VULMON: CVE-2019-1674 // 
            
            
            
            BID: 107184 // 
            
            
            
            JVNDB: JVNDB-2019-002555 // 
            
            
            
            CNNVD: CNNVD-201902-983 // 
            
            
            
            NVD: CVE-2019-1674

CREDITS
Core Security Technologies,Marcos Accossatto of SecureAuth .,Marcos Accossatto ?? ??,SecureAuth
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-201902-983

SOURCES
db:VULHUBid:VHN-148916
db:VULMONid:CVE-2019-1674
db:BIDid:107184
db:JVNDBid:JVNDB-2019-002555
db:CNNVDid:CNNVD-201902-983
db:NVDid:CVE-2019-1674

LAST UPDATE DATE
2024-11-23T22:37:55.147000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-148916date:2019-10-09T00:00:00
db:VULMONid:CVE-2019-1674date:2019-10-09T00:00:00
db:BIDid:107184date:2019-02-27T00:00:00
db:JVNDBid:JVNDB-2019-002555date:2019-04-11T00:00:00
db:CNNVDid:CNNVD-201902-983date:2019-10-17T00:00:00
db:NVDid:CVE-2019-1674date:2024-11-21T04:37:04.233

SOURCES RELEASE DATE
db:VULHUBid:VHN-148916date:2019-02-28T00:00:00
db:VULMONid:CVE-2019-1674date:2019-02-28T00:00:00
db:BIDid:107184date:2019-02-27T00:00:00
db:JVNDBid:JVNDB-2019-002555date:2019-04-11T00:00:00
db:CNNVDid:CNNVD-201902-983date:2019-02-27T00:00:00
db:NVDid:CVE-2019-1674date:2019-02-28T18:29:02.087