KLA12054 Multiple vulnerabilities in Cisco Jabber

Multiple vulnerabilities were found in Cisco Jabber. Malicious users can exploit these vulnerabilities to perform cross-site scripting attack, execute arbitrary code.

Below is a complete list of vulnerabilities:

1. A cross-site scripting vulnerability in Cisco Jabber Client Framework (JCF) can be exploited remotely to perform cross-site scripting attack.
2. A cross-site scripting vulnerability in Cisco Jabber Client Framework (JCF) can be exploited remotely to perform cross-site scripting attack and execute arbitrary code.

Original advisories

Cisco Jabber Client Framework for Windows and Mac Cross-Site Scripting Vulnerability

Cisco Jabber Client Framework for Windows and Mac Cross-Site Scripting Vulnerability

Related products

Cisco-Jabber

CVE list

CVE-2018-0201 high

CVE-2018-0199 high

Solution

Update to the latest version

Download Cisco Jabber

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• XSS/CSS

Cross site scripting. Exploitation of vulnerabilities with this impact can lead to partial interception of information transmitted between user and site.

Affected Products

• Cisco Jabber 11.9 and earlier