Medium severity · published Jul 17, 2024
CVE-2024-20396
A vulnerability in the protocol handlers of Cisco Webex App could allow an unauthenticated, remote attacker to gain access to sensitive information
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability in the protocol handlers of Cisco Webex App could allow an unauthenticated, remote attacker to gain access to sensitive information. This vulnerability exists because the affected application does not safely handle file protocol handlers. An attacker could exploit this vulnerability by persuading a user to follow a link that is designed to cause the application to send requests. If the attacker can observe transmitted traffic in a privileged network position, a successful exploit could allow the attacker to capture sensitive information, including credential information, from the requests.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CW
Cisco Webex Teams · Cisco
3.0.13464.0; 3.0.13538.0; 3.0.13588.0; 3.0.14154.0; 3.0.14234.0; 3.0.14375.0; +34 more · source: vendor
WT
Webex Teams · Cisco
3.0.13464.0; 3.0.13538.0; 3.0.13588.0; 3.0.14154.0; 3.0.14234.0; 3.0.14375.0; +34 more · source: NVD
Affected product
CW
Cisco Webex Teams
Cisco
More from Cisco Webex Teams
8.8
CVE-2025-20236
Cisco Webex App Client-Side Remote Code Execution Vulnerability
7.8
CVE-2019-1636
Cisco Webex Teams URI Handler Insecure Library Loading Vulnerability
7.3
CVE-2024-20395
A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access to sensitive session information
7.3
CVE-2019-1689
Cisco Webex Teams for iOS Arbitrary File Upload Vulnerability
5.4
CVE-2020-26067
Cisco Webex Teams Web Interface Cross-Site Scripting Vulnerability