CVE-2019-1636— Cisco Webex Teams 操作系统命令注入漏洞

Cisco Webex Teams URI Handler Insecure Library Loading Vulnerability

A vulnerability in the Cisco Webex Teams client, formerly Cisco Spark, could allow an attacker to execute arbitrary commands on a targeted system. This vulnerability is due to unsafe search paths used by the application URI that is defined in Windows operating systems. An attacker could exploit this vulnerability by convincing a targeted user to follow a malicious link. Successful exploitation could cause the application to load libraries from the directory targeted by the URI link. The attacker could use this behavior to execute arbitrary commands on the system with the privileges of the targeted user if the attacker can place a crafted library in a directory that is accessible to the vulnerable system.

N/A

OS命令中使用的特殊元素转义处理不恰当(OS命令注入)

Cisco Webex Teams 操作系统命令注入漏洞

Cisco Webex Teams是美国思科（Cisco）公司的一款团队协作应用程序。该程序包括视频会议、消息群发和文件共享等功能。 Cisco Webex Teams 3.0.10260之前版本中存在操作系统命令注入漏洞。攻击者可通过诱使用户打开恶意链接利用该漏洞在目标系统上执行任意命令。

N/A

N/A