{"id": "THN:571D82BCDF8B3E11D0F9AB26BF0B5CAB", "type": "thn", "bulletinFamily": "info", "title": "Critical Cisco Jabber Bug Could Let Attackers Hack Remote Systems", "description": "[](<https://thehackernews.com/images/-XwDv7U2sWJ8/YFxbsEmg0pI/AAAAAAAACGA/ZaH-loK8Uy8wbGthtq1Odot5s8ChWzSyQCLcBGAsYHQ/s0/cisco.jpg>)\n\nCisco on Wednesday released software updates to address multiple vulnerabilities affecting its Jabber messaging clients across Windows, macOS, Android, and iOS.\n\nSuccessful exploitation of the flaws could permit an \"attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information, intercept protected network traffic, or cause a denial of service (DoS) condition,\" the networking major [said](<https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cisco-jabber-PWrTATTC>) in an advisory.\n\nThe issues concern a total of five security vulnerabilities, three of which (CVE-2021-1411, CVE-2021-1417, and CVE-2021-1418) were reported to the company by Olav Sortland Thoresen of Watchcom, with two others (CVE-2021-1469 and CVE-2021-1471) uncovered during internal security testing.\n\nCisco notes that the flaws are not dependent on one another, and that exploitation of any one of the vulnerabilities doesn't hinge on the exploitation of another. But in order to do this, an attacker needs to be authenticated to an Extensible Messaging and Presence Protocol (XMPP) server running the vulnerable software, as well as be able to send XMPP messages.\n\n**CVE-2021-1411**, which concerns an arbitrary program execution vulnerability in its Windows app, is also the most critical, with a CVSS score of 9.9 out of a maximum of 10. According to Cisco, the flaw is due to improper validation of message content, thus making it possible for an attacker to send specially-crafted XMPP messages to the vulnerable client and execute arbitrary code with the same privileges as that of the user account running the software.\n\n[](<https://thehackernews.com/images/-WCPBQnzA_CI/YFxew4FX1pI/AAAAAAAA3ts/HLdZBhRLWdEHkXJ6_PM9RqNBsYfq3XaywCLcBGAsYHQ/s0/cisco.jpg>)\n\nBesides CVE-2021-1411, four other Jabber flaws have also been fixed by Cisco, counting \u2014\n\n * **CVE-2021-1469** (Windows) - An issue with improper validation of message content that could result in arbitrary code execution.\n * **CVE-2021-1417** (Windows) - A failure to validate message content that could be leveraged to leak sensitive information, which can then fuel further attacks.\n * **CVE-2021-1471** (Windows, macOS, Android, iOS) - A certificate validation vulnerability that could be abused to intercept network requests and even modify connections between the Jabber client and a server\n * **CVE-2021-1418** (Windows, macOS, Android, iOS) - An issue arising from improper validation of message content that could be exploited by sending crafted XMPP messages to cause a denial-of-service (DoS) condition.\n\nThis is far from the first time Norwegian cybersecurity firm Watchcom has uncovered flaws in Jabber clients. In September 2020, Cisco [resolved four flaws](<https://thehackernews.com/2020/09/cisco-jabber-hacking.html>) in its Windows app that could permit an authenticated, remote attacker to execute arbitrary code. But after three of the four vulnerabilities were not \"sufficiently mitigated,\" the company ended up releasing a [second round of patches](<https://thehackernews.com/2020/12/cisco-reissues-patches-for-critical.html>) in December.\n\nIn addition to the fix for Jabber, Cisco has also published [37 other advisories](<https://tools.cisco.com/security/center/Search.x?publicationTypeIDs=1&firstPublishedStartDate=2021%2F03%2F24&firstPublishedEndDate=2021%2F03%2F24>) that go into detail about security updates for a number of medium and high severity issues affecting various Cisco products.\n\n \n\n\nFound this article interesting? Follow THN on [Facebook](<https://www.facebook.com/thehackernews>), [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "published": "2021-03-25T09:50:00", "modified": "2021-03-26T03:48:20", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://thehackernews.com/2021/03/critical-cisco-jabber-bug-could-let.html", "reporter": "The Hacker News", "references": [], "cvelist": ["CVE-2021-1411", "CVE-2021-1417", "CVE-2021-1418", "CVE-2021-1469", "CVE-2021-1471"], "lastseen": "2021-03-26T05:08:29", "viewCount": 60, "enchantments": {"dependencies": {"references": [{"type": "cisco", "idList": ["CISCO-SA-CISCO-JABBER-PWRTATTC"]}, {"type": "nessus", "idList": ["CISCO-SA-CISCO-JABBER-PWRTATTC.NASL"]}, {"type": "cve", "idList": ["CVE-2021-1469", "CVE-2021-1417", "CVE-2021-1418", "CVE-2021-1411", "CVE-2021-1471"]}], "modified": "2021-03-26T05:08:29", "rev": 2}, "score": {"value": 6.5, "vector": "NONE", "modified": "2021-03-26T05:08:29", "rev": 2}, "vulnersScore": 6.5}, "immutableFields": []}

{"cisco": [{"lastseen": "2021-03-25T14:18:14", "bulletinFamily": "software", "cvelist": ["CVE-2021-1411", "CVE-2021-1417", "CVE-2021-1418", "CVE-2021-1469", "CVE-2021-1471"], "description": "Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information, intercept protected network traffic, or cause a denial of service (DoS) condition.\n\nFor more information about these vulnerabilities, see the Details [\"#details\"] section of this advisory.\n\nCisco has released software updates that address these vulnerabilities. There are no workarounds that address these vulnerabilities.\n\nThis advisory is available at the following link:\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cisco-jabber-PWrTATTC [\"https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cisco-jabber-PWrTATTC\"]", "modified": "2021-03-25T13:44:34", "published": "2021-03-24T16:00:00", "id": "CISCO-SA-CISCO-JABBER-PWRTATTC", "href": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cisco-jabber-PWrTATTC", "type": "cisco", "title": "Cisco Jabber Desktop and Mobile Client Software Vulnerabilities", "cvss": {"score": 9.9, "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}}], "nessus": [{"lastseen": "2021-04-07T22:50:10", "description": "According to its self-reported version, Cisco Jabber is affected by multiple vulnerabilities which could allow a \nremote, authenticated attacker to execute arbitrary programs on the underlying operating system with the\nprivileges of the user account that is running the Cisco Jabber client software or gain access to sensitive\ninformation.\n\nPlease see the included Cisco BIDs and Cisco Security Advisory for more information.", "edition": 3, "cvss3": {"score": 9.9, "vector": "AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"}, "published": "2021-03-26T00:00:00", "title": "Cisco Jabber Multiple Vulnerabilities (cisco-sa-cisco-jabber-PWrTATTC)", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2021-1417", "CVE-2021-1418", "CVE-2021-1469", "CVE-2021-1471", "CVE-2021-1411"], "modified": "2021-03-26T00:00:00", "cpe": ["cpe:/a:cisco:jabber"], "id": "CISCO-SA-CISCO-JABBER-PWRTATTC.NASL", "href": "https://www.tenable.com/plugins/nessus/148137", "sourceData": "##\n# (C) Tenable Network Security, Inc.\n##\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(148137);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/04/07\");\n\n script_cve_id(\n \"CVE-2021-1411\",\n \"CVE-2021-1417\",\n \"CVE-2021-1418\",\n \"CVE-2021-1469\",\n \"CVE-2021-1471\"\n );\n script_xref(name:\"CISCO-BUG-ID\", value:\"CSCvw96073\");\n script_xref(name:\"CISCO-BUG-ID\", value:\"CSCvw96075\");\n script_xref(name:\"CISCO-BUG-ID\", value:\"CSCvw96079\");\n script_xref(name:\"CISCO-BUG-ID\", value:\"CSCvx36433\");\n script_xref(name:\"CISCO-BUG-ID\", value:\"CSCvx43270\");\n script_xref(name:\"CISCO-SA\", value:\"cisco-sa-cisco-jabber-PWrTATTC\");\n script_xref(name:\"IAVA\", value:\"2021-A-0142\");\n\n script_name(english:\"Cisco Jabber Multiple Vulnerabilities (cisco-sa-cisco-jabber-PWrTATTC)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote device is missing a vendor-supplied security patch.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its self-reported version, Cisco Jabber is affected by multiple vulnerabilities which could allow a \nremote, authenticated attacker to execute arbitrary programs on the underlying operating system with the\nprivileges of the user account that is running the Cisco Jabber client software or gain access to sensitive\ninformation.\n\nPlease see the included Cisco BIDs and Cisco Security Advisory for more information.\");\n # https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cisco-jabber-PWrTATTC\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?907b8da4\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvw96073\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvw96075\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvw96079\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx36433\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx43270\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to the relevant fixed version referenced in the relevant Cisco Security Advisory\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2021-1411\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2021/03/24\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2021/03/24\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2021/03/26\");\n\n script_set_attribute(attribute:\"agent\", value:\"all\");\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:cisco:jabber\");\n script_set_attribute(attribute:\"stig_severity\", value:\"I\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Misc.\");\n\n script_copyright(english:\"This script is Copyright (C) 2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"cisco_jabber_client_installed.nbin\", \"macosx_cisco_jabber_for_mac_installed.nbin\");\n script_require_ports(\"installed_sw/Cisco Jabber for Windows\", \"installed_sw/Cisco Jabber\");\n\n exit(0);\n}\n\ninclude('vcf.inc');\n\nif (get_kb_item('SMB/Registry/Enumerated'))\n{\n app_info = vcf::get_app_info(app:'Cisco Jabber for Windows', win_local:TRUE);\n\n constraints = [\n { 'min_version' : '0.0 ', 'fixed_version' : '12.1.5'},\n { 'min_version' : '12.5 ', 'fixed_version' : '12.5.4'},\n { 'min_version' : '12.6 ', 'fixed_version' : '12.6.5'},\n { 'min_version' : '12.7 ', 'fixed_version' : '12.7.4'},\n { 'min_version' : '12.8 ', 'fixed_version' : '12.8.5'},\n { 'min_version' : '12.9 ', 'fixed_version' : '12.9.5'}\n ];\n}\nelse\n{\n app_info = vcf::get_app_info(app:'Cisco Jabber', win_local:FALSE);\n\n constraints = [\n { 'min_version' : '0.0 ', 'fixed_version' : '12.8.7'},\n { 'min_version' : '12.9 ', 'fixed_version' : '12.9.6'}\n ];\n}\n\nvcf::check_version_and_report(\n app_info:app_info,\n constraints:constraints,\n severity:SECURITY_HOLE\n);\n", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}}], "cve": [{"lastseen": "2021-03-30T12:45:28", "description": "Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information, intercept protected network traffic, or cause a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory.", "edition": 2, "cvss3": {"exploitabilityScore": 1.2, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 7.2, "privilegesRequired": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2021-03-24T20:15:00", "title": "CVE-2021-1469", "type": "cve", "cwe": ["CWE-170", "CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.5, "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-1469"], "modified": "2021-03-29T17:45:00", "cpe": [], "id": "CVE-2021-1469", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-1469", "cvss": {"score": 6.5, "vector": "AV:N/AC:L/Au:S/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2021-03-30T12:45:28", "description": "Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information, intercept protected network traffic, or cause a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory.", "edition": 2, "cvss3": {"exploitabilityScore": 2.2, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "LOW", "integrityImpact": "LOW", "baseScore": 5.6, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.4}, "published": "2021-03-24T20:15:00", "title": "CVE-2021-1471", "type": "cve", "cwe": ["CWE-295"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 6.4, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-1471"], "modified": "2021-03-29T17:37:00", "cpe": ["cpe:/a:cisco:jabber:12.9.0"], "id": "CVE-2021-1471", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-1471", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:cisco:jabber:12.9.0:*:*:*:*:android:*:*", "cpe:2.3:a:cisco:jabber:12.9.0:*:*:*:*:iphone_os:*:*"]}, {"lastseen": "2021-03-30T12:45:28", "description": "Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information, intercept protected network traffic, or cause a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory.", "edition": 2, "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2021-03-24T21:15:00", "title": "CVE-2021-1417", "type": "cve", "cwe": ["CWE-200"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-1417"], "modified": "2021-03-29T17:13:00", "cpe": [], "id": "CVE-2021-1417", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-1417", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:P/I:N/A:N"}, "cpe23": []}, {"lastseen": "2021-03-30T12:45:28", "description": "Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information, intercept protected network traffic, or cause a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory.", "edition": 2, "cvss3": {"exploitabilityScore": 3.1, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.9, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 6.0}, "published": "2021-03-24T21:15:00", "title": "CVE-2021-1411", "type": "cve", "cwe": ["CWE-170"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.0, "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-1411"], "modified": "2021-03-29T17:32:00", "cpe": [], "id": "CVE-2021-1411", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-1411", "cvss": {"score": 9.0, "vector": "AV:N/AC:L/Au:S/C:C/I:C/A:C"}, "cpe23": []}, {"lastseen": "2021-03-30T12:45:28", "description": "Multiple vulnerabilities in Cisco Jabber for Windows, Cisco Jabber for MacOS, and Cisco Jabber for mobile platforms could allow an attacker to execute arbitrary programs on the underlying operating system with elevated privileges, access sensitive information, intercept protected network traffic, or cause a denial of service (DoS) condition. For more information about these vulnerabilities, see the Details section of this advisory.", "edition": 2, "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "baseScore": 6.5, "privilegesRequired": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2021-03-24T21:15:00", "title": "CVE-2021-1418", "type": "cve", "cwe": ["CWE-170"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "PARTIAL", "integrityImpact": "NONE", "baseScore": 4.0, "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "SINGLE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-1418"], "modified": "2021-03-29T17:46:00", "cpe": ["cpe:/a:cisco:jabber:12.9.0"], "id": "CVE-2021-1418", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-1418", "cvss": {"score": 4.0, "vector": "AV:N/AC:L/Au:S/C:N/I:N/A:P"}, "cpe23": ["cpe:2.3:a:cisco:jabber:12.9.0:*:*:*:*:android:*:*", "cpe:2.3:a:cisco:jabber:12.9.0:*:*:*:*:iphone_os:*:*"]}]}