CVE-2019-1636 is a vulnerability in Cisco Webex Teams
Published on January 23, 2019
Cisco Webex Teams URI Handler Insecure Library Loading Vulnerability
A vulnerability in the Cisco Webex Teams client, formerly Cisco Spark, could allow an attacker to execute arbitrary commands on a targeted system. This vulnerability is due to unsafe search paths used by the application URI that is defined in Windows operating systems. An attacker could exploit this vulnerability by convincing a targeted user to follow a malicious link. Successful exploitation could cause the application to load libraries from the directory targeted by the URI link. The attacker could use this behavior to execute arbitrary commands on the system with the privileges of the targeted user if the attacker can place a crafted library in a directory that is accessible to the vulnerable system.
Weakness Type
What is a Shell injection Vulnerability?
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVE-2019-1636 has been classified to as a Shell injection vulnerability or weakness.
Products Associated with CVE-2019-1636
Want to know whenever a new CVE is published for Cisco Webex Teams? stack.watch will email you.
Affected Versions
Cisco Webex Teams Version n/a is affected by CVE-2019-1636Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.