CVE-2022-20863

{"id": "CVE-2022-20863", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "ykramarz@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "published": "2022-09-08T13:15:08.930", "references": [{"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-app-qrtO6YC2", "tags": ["Vendor Advisory"], "source": "ykramarz@cisco.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "ykramarz@cisco.com", "description": [{"lang": "en", "value": "CWE-450"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the messaging interface of Cisco Webex App, formerly Webex Teams, could allow an unauthenticated, remote attacker to manipulate links or other content within the messaging interface. This vulnerability exists because the affected software does not properly handle character rendering. An attacker could exploit this vulnerability by sending messages within the application interface. A successful exploit could allow the attacker to modify the display of links or other content within the interface, potentially allowing the attacker to conduct phishing or spoofing attacks."}, {"lang": "es", "value": "Una vulnerabilidad en la interfaz de mensajer\u00eda de la aplicaci\u00f3n Cisco Webex, anteriormente Webex Teams, podr\u00eda permitir a un atacante remoto no autenticado manipular enlaces u otro contenido dentro de la interfaz de mensajer\u00eda. Esta vulnerabilidad se presenta porque el software afectado no maneja apropiadamente la representaci\u00f3n de caracteres. Un atacante podr\u00eda explotar esta vulnerabilidad mediante el env\u00edo de mensajes dentro de la interfaz de la aplicaci\u00f3n. Una explotaci\u00f3n con \u00e9xito podr\u00eda permitir al atacante modificar la visualizaci\u00f3n de enlaces u otro contenido dentro de la interfaz, lo que podr\u00eda permitirle conducir ataques de phishing o suplantaci\u00f3n de identidad"}], "lastModified": "2023-11-07T03:43:09.390", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:cisco:webex_teams:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A333C399-691C-45CF-B8C1-B1E9C3DED212", "versionEndExcluding": "42.7"}], "operator": "OR"}]}], "sourceIdentifier": "ykramarz@cisco.com"}