Vulnerability-Lookup

BDU:2022-06330 (CVE-2022-20917)

Vulnerability from fstec – Published: 2022-10-18 – Updated: 2022-10-18 – View on bdu.fstec.ru Fixed

Title

Уязвимость реализации протокола Extensible Messaging and Presence Protocol (XMPP) программных платформ Cisco Jabber for Windows, Cisco Jabber for MacOS, Cisco Jabber for Android and iOS, Cisco Jabber for Android MAM и Cisco Jabber for iOS MAM, позволяющая нарушителю отправить скрытый HTTP-запрос (атака типа "HTTP Request Smuggling")

Summary

Уязвимость реализации протокола Extensible Messaging and Presence Protocol (XMPP) программных платформ Cisco Jabber for Windows, Cisco Jabber for MacOS, Cisco Jabber for Android and iOS, Cisco Jabber for Android MAM и Cisco Jabber for iOS MAM связана с раскрытием информации в ошибочной области данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, отправить скрытый HTTP-запрос (атака типа "HTTP Request Smuggling") с помощью специально созданных XMPP-сообщений

Severity

5.0 (Medium) CVSS 2.0


                      
                        AV:N/AC:L/Au:N/C:N/I:P/A:N

4.3 (Medium) CVSS 3.0


                      
                        CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Class

Architecture vulnerability

Status

Confirmed by the vendor

Exploitation

Information gathering

Incidents

Being clarified

Remediation

Software update

CWE

CWE-668 - Раскрытие ресурса для ошибочной области

Aliases

CVE-2022-20917

References

1 reference

URL
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-…

Impacted products

6 products from 2 vendors

Vendors

Cisco Systems, Inc.

Products

Jabber for Windows, Jabber for MacOS, Cisco Jabber for Android, Cisco Jabber for iOS, Cisco Jabber for Android MAM, Cisco Jabber for iOS MAM

Versions

до 12.6.6 (Jabber for Windows), от 12.7 до 12.7.6 (Jabber for Windows), от 12.8 до 12.8.7 (Jabber for Windows), от 12.9 до 12.9.7 (Jabber for Windows), от 14.0 до 14.0.5 (Jabber for Windows), от 14.1 до 14.1.3 (Jabber for Windows), до 12.8.8 (Jabber for MacOS), от 12.9 до 12.9.8 (Jabber for MacOS), от 14.0 до 14.0.5 (Jabber for MacOS), от 14.1 до 14.1.3 (Jabber for MacOS), до 14.1.4 (Cisco Jabber for Android), до 14.1.4 (Cisco Jabber for iOS), до 14.1.4 (Nov 2022) (Cisco Jabber for Android MAM), до 14.1.4 (Cisco Jabber for iOS MAM)

Product types

Network software, Application software, Network device

Mitigations

Использование рекомендаций: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-xmpp-Ne9SCM

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
  "CVSS 3.0": "AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Cisco Systems, Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 12.6.6 (Jabber for Windows), \u043e\u0442 12.7 \u0434\u043e 12.7.6 (Jabber for Windows), \u043e\u0442 12.8 \u0434\u043e 12.8.7 (Jabber for Windows), \u043e\u0442 12.9 \u0434\u043e 12.9.7 (Jabber for Windows), \u043e\u0442 14.0 \u0434\u043e 14.0.5 (Jabber for Windows), \u043e\u0442 14.1 \u0434\u043e 14.1.3 (Jabber for Windows), \u0434\u043e 12.8.8 (Jabber for MacOS), \u043e\u0442 12.9 \u0434\u043e 12.9.8 (Jabber for MacOS), \u043e\u0442 14.0 \u0434\u043e 14.0.5 (Jabber for MacOS), \u043e\u0442 14.1 \u0434\u043e 14.1.3 (Jabber for MacOS), \u0434\u043e 14.1.4 (Cisco Jabber for Android), \u0434\u043e 14.1.4 (Cisco Jabber for iOS), \u0434\u043e 14.1.4 (Nov 2022) (Cisco Jabber for Android MAM), \u0434\u043e 14.1.4 (Cisco Jabber for iOS MAM)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-xmpp-Ne9SCM",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "05.10.2022",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "18.10.2022",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "18.10.2022",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2022-06330",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2022-20917",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Jabber for Windows, Jabber for MacOS, Cisco Jabber for Android, Cisco Jabber for iOS, Cisco Jabber for Android MAM, Cisco Jabber for iOS MAM",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 Extensible Messaging and Presence Protocol (XMPP) \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c Cisco Jabber for Windows, Cisco Jabber for MacOS, Cisco Jabber for Android and iOS, Cisco Jabber for Android MAM \u0438 Cisco Jabber for iOS MAM, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0441\u043a\u0440\u044b\u0442\u044b\u0439 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441 (\u0430\u0442\u0430\u043a\u0430 \u0442\u0438\u043f\u0430 \"HTTP Request Smuggling\")",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u0430 \u0434\u043b\u044f \u043e\u0448\u0438\u0431\u043e\u0447\u043d\u043e\u0439 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 (CWE-668)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 Extensible Messaging and Presence Protocol (XMPP) \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u0445 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c Cisco Jabber for Windows, Cisco Jabber for MacOS, Cisco Jabber for Android and iOS, Cisco Jabber for Android MAM \u0438 Cisco Jabber for iOS MAM \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435\u043c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u043e\u0448\u0438\u0431\u043e\u0447\u043d\u043e\u0439 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0441\u043a\u0440\u044b\u0442\u044b\u0439 HTTP-\u0437\u0430\u043f\u0440\u043e\u0441 (\u0430\u0442\u0430\u043a\u0430 \u0442\u0438\u043f\u0430 \"HTTP Request Smuggling\") \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u0441\u043e\u0437\u0434\u0430\u043d\u043d\u044b\u0445 XMPP-\u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0439",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0431\u043e\u0440 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-xmpp-Ne9SCM",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e, \u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c, \u0421\u0435\u0442\u0435\u0432\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-668",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 5)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 4,3)"
}

CVE-2022-20917 (GCVE-0-2022-20917)

Vulnerability from cvelistv5 – Published: 2023-09-15 02:12 – Updated: 2024-09-25 14:13

Summary

A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) message processing feature of Cisco Jabber could allow an authenticated, remote attacker to manipulate the content of XMPP messages that are used by the affected application. This vulnerability is due to the improper handling of nested XMPP messages within requests that are sent to the Cisco Jabber client software. An attacker could exploit this vulnerability by connecting to an XMPP messaging server and sending crafted XMPP messages to an affected Jabber client. A successful exploit could allow the attacker to manipulate the content of XMPP messages, possibly allowing the attacker to cause the Jabber client application to perform unsafe actions.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-09-25 14:03 UTC

CWE

CWE-668 - Exposure of Resource to Wrong Sphere

Assigner

cisco mitre root Scorecard

References

1 reference

URL	Tags
https://sec.cloudapps.cisco.com/security/center/c…

Impacted products

1 product

Vendor	Product	Version
Cisco	Cisco Jabber	Affected: 10.5(0) Affected: 10.5(1) Affected: 10.5(2) Affected: 10.5(3) Affected: 10.5(4) Affected: 10.5(5) Affected: 10.5(6) Affected: 10.6(0) Affected: 10.6(1) Affected: 10.6(2) Affected: 10.6(3) Affected: 10.6(4) Affected: 10.6(5) Affected: 10.6(6) Affected: 10.6(7) Affected: 10.6(10) Affected: 10.6(11) Affected: 10.6(12) Affected: 10.6(8) Affected: 10.6(9) Affected: 11.0(0) Affected: 11.0(1) Affected: 11.0(2) Affected: 11.1(0) Affected: 11.1(1) Affected: 11.1(2) Affected: 11.1(3) Affected: 11.1(4) Affected: 11.5(0) Affected: 11.5(1) Affected: 11.5(2) Affected: 11.5(3) Affected: 11.5(4) Affected: 11.5(5) Affected: 11.5(6) Affected: 11.6(0) Affected: 11.6(1) Affected: 11.6(2) Affected: 11.6(3) Affected: 11.6(4) Affected: 11.7(0) Affected: 11.7(1) Affected: 11.7(2) Affected: 11.8(0) Affected: 11.8(1) Affected: 11.8(2) Affected: 11.8(3) Affected: 11.8(4) Affected: 11.8(5) Affected: 11.9(0) Affected: 11.9(1) Affected: 11.9(2) Affected: 11.9(3) Affected: 12.0(0) Affected: 12.0(1) Affected: 12.1(0) Affected: 12.1(1) Affected: 12.1(2) Affected: 12.1(3) Affected: 12.1(4) Affected: 12.1(5) Affected: 12.5(0) Affected: 12.5(1) Affected: 12.5(2) Affected: 12.5(3) Affected: 12.5(4) Affected: 12.6(0) Affected: 12.6(1) Affected: 12.6(2) Affected: 12.6(3) Affected: 12.6(4) Affected: 12.6(5) Affected: 12.7(0) Affected: 12.7(1) Affected: 12.7(2) Affected: 12.7(3) Affected: 12.7(4) Affected: 12.7(5) Affected: 12.8(0) Affected: 12.8(1) Affected: 12.8(2) Affected: 12.8(3) Affected: 12.8(4) Affected: 12.8(5) Affected: 12.8(6) Affected: 12.8(7) Affected: 12.9(0) Affected: 12.9(1) Affected: 12.9(2) Affected: 12.9(3) Affected: 12.9(4) Affected: 12.9(5) Affected: 12.9(6) Affected: 8.6(1) Affected: 8.6(2) Affected: 8.6(3) Affected: 8.6(4) Affected: 8.6(5) Affected: 8.6(6) Affected: 8.6(7) Affected: 9.0(1) Affected: 9.0(2) Affected: 9.0(3) Affected: 9.0(4) Affected: 9.0(5) Affected: 9.1(0) Affected: 9.1(1) Affected: 9.1(2) Affected: 9.1(3) Affected: 9.1(4) Affected: 9.1(5) Affected: 9.2(0) Affected: 9.2(1) Affected: 9.2(2) Affected: 9.2(3) Affected: 9.2(4) Affected: 9.2(5) Affected: 9.2(6) Affected: 9.2(7) Affected: 9.3(1) Affected: 9.3(2) Affected: 9.5(0) Affected: 9.6(0) Affected: 9.6(1) Affected: 9.6(2) Affected: 9.6(3) Affected: 9.6(4) Affected: 9.7(0) Affected: 9.7(1) Affected: 9.7(2) Affected: 9.7(3) Affected: 9.7(4) Affected: 9.7(5) Affected: 9.7(6) Affected: 9.7(7) Affected: Jabber For Windows Affected: 14.0(0) Affected: 14.0(1) Affected: 14.0(2) Affected: 14.0(3) Affected: 14.0(4) Affected: 11.2(0) Affected: 11.2(1) Affected: 14.1(0) Affected: 14.1(1) Affected: 14.1(2)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T02:31:57.691Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "cisco-sa-jabber-xmpp-Ne9SCM",
            "tags": [
              "x_transferred"
            ],
            "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-xmpp-Ne9SCM"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-20917",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-25T14:03:09.028059Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-25T14:13:11.945Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Cisco Jabber",
          "vendor": "Cisco",
          "versions": [
            {
              "status": "affected",
              "version": "10.5(0)"
            },
            {
              "status": "affected",
              "version": "10.5(1)"
            },
            {
              "status": "affected",
              "version": "10.5(2)"
            },
            {
              "status": "affected",
              "version": "10.5(3)"
            },
            {
              "status": "affected",
              "version": "10.5(4)"
            },
            {
              "status": "affected",
              "version": "10.5(5)"
            },
            {
              "status": "affected",
              "version": "10.5(6)"
            },
            {
              "status": "affected",
              "version": "10.6(0)"
            },
            {
              "status": "affected",
              "version": "10.6(1)"
            },
            {
              "status": "affected",
              "version": "10.6(2)"
            },
            {
              "status": "affected",
              "version": "10.6(3)"
            },
            {
              "status": "affected",
              "version": "10.6(4)"
            },
            {
              "status": "affected",
              "version": "10.6(5)"
            },
            {
              "status": "affected",
              "version": "10.6(6)"
            },
            {
              "status": "affected",
              "version": "10.6(7)"
            },
            {
              "status": "affected",
              "version": "10.6(10)"
            },
            {
              "status": "affected",
              "version": "10.6(11)"
            },
            {
              "status": "affected",
              "version": "10.6(12)"
            },
            {
              "status": "affected",
              "version": "10.6(8)"
            },
            {
              "status": "affected",
              "version": "10.6(9)"
            },
            {
              "status": "affected",
              "version": "11.0(0)"
            },
            {
              "status": "affected",
              "version": "11.0(1)"
            },
            {
              "status": "affected",
              "version": "11.0(2)"
            },
            {
              "status": "affected",
              "version": "11.1(0)"
            },
            {
              "status": "affected",
              "version": "11.1(1)"
            },
            {
              "status": "affected",
              "version": "11.1(2)"
            },
            {
              "status": "affected",
              "version": "11.1(3)"
            },
            {
              "status": "affected",
              "version": "11.1(4)"
            },
            {
              "status": "affected",
              "version": "11.5(0)"
            },
            {
              "status": "affected",
              "version": "11.5(1)"
            },
            {
              "status": "affected",
              "version": "11.5(2)"
            },
            {
              "status": "affected",
              "version": "11.5(3)"
            },
            {
              "status": "affected",
              "version": "11.5(4)"
            },
            {
              "status": "affected",
              "version": "11.5(5)"
            },
            {
              "status": "affected",
              "version": "11.5(6)"
            },
            {
              "status": "affected",
              "version": "11.6(0)"
            },
            {
              "status": "affected",
              "version": "11.6(1)"
            },
            {
              "status": "affected",
              "version": "11.6(2)"
            },
            {
              "status": "affected",
              "version": "11.6(3)"
            },
            {
              "status": "affected",
              "version": "11.6(4)"
            },
            {
              "status": "affected",
              "version": "11.7(0)"
            },
            {
              "status": "affected",
              "version": "11.7(1)"
            },
            {
              "status": "affected",
              "version": "11.7(2)"
            },
            {
              "status": "affected",
              "version": "11.8(0)"
            },
            {
              "status": "affected",
              "version": "11.8(1)"
            },
            {
              "status": "affected",
              "version": "11.8(2)"
            },
            {
              "status": "affected",
              "version": "11.8(3)"
            },
            {
              "status": "affected",
              "version": "11.8(4)"
            },
            {
              "status": "affected",
              "version": "11.8(5)"
            },
            {
              "status": "affected",
              "version": "11.9(0)"
            },
            {
              "status": "affected",
              "version": "11.9(1)"
            },
            {
              "status": "affected",
              "version": "11.9(2)"
            },
            {
              "status": "affected",
              "version": "11.9(3)"
            },
            {
              "status": "affected",
              "version": "12.0(0)"
            },
            {
              "status": "affected",
              "version": "12.0(1)"
            },
            {
              "status": "affected",
              "version": "12.1(0)"
            },
            {
              "status": "affected",
              "version": "12.1(1)"
            },
            {
              "status": "affected",
              "version": "12.1(2)"
            },
            {
              "status": "affected",
              "version": "12.1(3)"
            },
            {
              "status": "affected",
              "version": "12.1(4)"
            },
            {
              "status": "affected",
              "version": "12.1(5)"
            },
            {
              "status": "affected",
              "version": "12.5(0)"
            },
            {
              "status": "affected",
              "version": "12.5(1)"
            },
            {
              "status": "affected",
              "version": "12.5(2)"
            },
            {
              "status": "affected",
              "version": "12.5(3)"
            },
            {
              "status": "affected",
              "version": "12.5(4)"
            },
            {
              "status": "affected",
              "version": "12.6(0)"
            },
            {
              "status": "affected",
              "version": "12.6(1)"
            },
            {
              "status": "affected",
              "version": "12.6(2)"
            },
            {
              "status": "affected",
              "version": "12.6(3)"
            },
            {
              "status": "affected",
              "version": "12.6(4)"
            },
            {
              "status": "affected",
              "version": "12.6(5)"
            },
            {
              "status": "affected",
              "version": "12.7(0)"
            },
            {
              "status": "affected",
              "version": "12.7(1)"
            },
            {
              "status": "affected",
              "version": "12.7(2)"
            },
            {
              "status": "affected",
              "version": "12.7(3)"
            },
            {
              "status": "affected",
              "version": "12.7(4)"
            },
            {
              "status": "affected",
              "version": "12.7(5)"
            },
            {
              "status": "affected",
              "version": "12.8(0)"
            },
            {
              "status": "affected",
              "version": "12.8(1)"
            },
            {
              "status": "affected",
              "version": "12.8(2)"
            },
            {
              "status": "affected",
              "version": "12.8(3)"
            },
            {
              "status": "affected",
              "version": "12.8(4)"
            },
            {
              "status": "affected",
              "version": "12.8(5)"
            },
            {
              "status": "affected",
              "version": "12.8(6)"
            },
            {
              "status": "affected",
              "version": "12.8(7)"
            },
            {
              "status": "affected",
              "version": "12.9(0)"
            },
            {
              "status": "affected",
              "version": "12.9(1)"
            },
            {
              "status": "affected",
              "version": "12.9(2)"
            },
            {
              "status": "affected",
              "version": "12.9(3)"
            },
            {
              "status": "affected",
              "version": "12.9(4)"
            },
            {
              "status": "affected",
              "version": "12.9(5)"
            },
            {
              "status": "affected",
              "version": "12.9(6)"
            },
            {
              "status": "affected",
              "version": "8.6(1)"
            },
            {
              "status": "affected",
              "version": "8.6(2)"
            },
            {
              "status": "affected",
              "version": "8.6(3)"
            },
            {
              "status": "affected",
              "version": "8.6(4)"
            },
            {
              "status": "affected",
              "version": "8.6(5)"
            },
            {
              "status": "affected",
              "version": "8.6(6)"
            },
            {
              "status": "affected",
              "version": "8.6(7)"
            },
            {
              "status": "affected",
              "version": "9.0(1)"
            },
            {
              "status": "affected",
              "version": "9.0(2)"
            },
            {
              "status": "affected",
              "version": "9.0(3)"
            },
            {
              "status": "affected",
              "version": "9.0(4)"
            },
            {
              "status": "affected",
              "version": "9.0(5)"
            },
            {
              "status": "affected",
              "version": "9.1(0)"
            },
            {
              "status": "affected",
              "version": "9.1(1)"
            },
            {
              "status": "affected",
              "version": "9.1(2)"
            },
            {
              "status": "affected",
              "version": "9.1(3)"
            },
            {
              "status": "affected",
              "version": "9.1(4)"
            },
            {
              "status": "affected",
              "version": "9.1(5)"
            },
            {
              "status": "affected",
              "version": "9.2(0)"
            },
            {
              "status": "affected",
              "version": "9.2(1)"
            },
            {
              "status": "affected",
              "version": "9.2(2)"
            },
            {
              "status": "affected",
              "version": "9.2(3)"
            },
            {
              "status": "affected",
              "version": "9.2(4)"
            },
            {
              "status": "affected",
              "version": "9.2(5)"
            },
            {
              "status": "affected",
              "version": "9.2(6)"
            },
            {
              "status": "affected",
              "version": "9.2(7)"
            },
            {
              "status": "affected",
              "version": "9.3(1)"
            },
            {
              "status": "affected",
              "version": "9.3(2)"
            },
            {
              "status": "affected",
              "version": "9.5(0)"
            },
            {
              "status": "affected",
              "version": "9.6(0)"
            },
            {
              "status": "affected",
              "version": "9.6(1)"
            },
            {
              "status": "affected",
              "version": "9.6(2)"
            },
            {
              "status": "affected",
              "version": "9.6(3)"
            },
            {
              "status": "affected",
              "version": "9.6(4)"
            },
            {
              "status": "affected",
              "version": "9.7(0)"
            },
            {
              "status": "affected",
              "version": "9.7(1)"
            },
            {
              "status": "affected",
              "version": "9.7(2)"
            },
            {
              "status": "affected",
              "version": "9.7(3)"
            },
            {
              "status": "affected",
              "version": "9.7(4)"
            },
            {
              "status": "affected",
              "version": "9.7(5)"
            },
            {
              "status": "affected",
              "version": "9.7(6)"
            },
            {
              "status": "affected",
              "version": "9.7(7)"
            },
            {
              "status": "affected",
              "version": "Jabber For Windows"
            },
            {
              "status": "affected",
              "version": "14.0(0)"
            },
            {
              "status": "affected",
              "version": "14.0(1)"
            },
            {
              "status": "affected",
              "version": "14.0(2)"
            },
            {
              "status": "affected",
              "version": "14.0(3)"
            },
            {
              "status": "affected",
              "version": "14.0(4)"
            },
            {
              "status": "affected",
              "version": "11.2(0)"
            },
            {
              "status": "affected",
              "version": "11.2(1)"
            },
            {
              "status": "affected",
              "version": "14.1(0)"
            },
            {
              "status": "affected",
              "version": "14.1(1)"
            },
            {
              "status": "affected",
              "version": "14.1(2)"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) message processing feature of Cisco Jabber could allow an authenticated, remote attacker to manipulate the content of XMPP messages that are used by the affected application.\r\n This vulnerability is due to the improper handling of nested XMPP messages within requests that are sent to the Cisco Jabber client software. An attacker could exploit this vulnerability by connecting to an XMPP messaging server and sending crafted XMPP messages to an affected Jabber client. A successful exploit could allow the attacker to manipulate the content of XMPP messages, possibly allowing the attacker to cause the Jabber client application to perform unsafe actions."
        }
      ],
      "exploits": [
        {
          "lang": "en",
          "value": "The Cisco PSIRT is aware that proof-of-concept exploit code is available for the vulnerability that is described in this advisory.\r\n\r\nThe Cisco PSIRT is not aware of any malicious use of the vulnerability that is described in this advisory."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          },
          "format": "cvssV3_1"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-668",
              "description": "Exposure of Resource to Wrong Sphere",
              "lang": "en",
              "type": "cwe"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-01-25T16:57:12.844Z",
        "orgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
        "shortName": "cisco"
      },
      "references": [
        {
          "name": "cisco-sa-jabber-xmpp-Ne9SCM",
          "url": "https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-jabber-xmpp-Ne9SCM"
        }
      ],
      "source": {
        "advisory": "cisco-sa-jabber-xmpp-Ne9SCM",
        "defects": [
          "CSCwc24382"
        ],
        "discovery": "EXTERNAL"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "d1c1063e-7a18-46af-9102-31f8928bc633",
    "assignerShortName": "cisco",
    "cveId": "CVE-2022-20917",
    "datePublished": "2023-09-15T02:12:51.048Z",
    "dateReserved": "2021-11-02T13:28:29.189Z",
    "dateUpdated": "2024-09-25T14:13:11.945Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2022-06330 (CVE-2022-20917)

CVE-2022-20917 (GCVE-0-2022-20917)

Tags

Sightings

Nomenclature

Related by attack behaviour