CVE-2024-20395
Published: 17 July 2024
Summary
CVE-2024-20395 is a medium-severity Unprotected Transport of Credentials (CWE-523) vulnerability in Cisco Webex Teams. Its CVSS base score is 6.4 (Medium).
Operationally, ranked at the 42.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-18110
Vulnerability details
A vulnerability in the media retrieval functionality of Cisco Webex App could allow an unauthenticated, adjacent attacker to gain access to sensitive session information. This vulnerability is due to insecure transmission of requests to backend services when the app accesses…
more
embedded media, such as images. An attacker could exploit this vulnerability by sending a message with embedded media that is stored on a messaging server to a targeted user. If the attacker can observe transmitted traffic in a privileged network position, a successful exploit could allow the attacker to capture session token information from insecurely transmitted requests and possibly reuse the captured session information to take further actions as the targeted user.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Using a distinct channel for credential transmission prevents unprotected transport over the application's normal communication path.
Requiring protected transport for credentials directly mitigates unprotected credential transmission over networks.
Prevents unprotected transport of credentials by mandating confidentiality mechanisms such as TLS for all sensitive data flows.