Cisco Webex Teams vulnerability could lead to cross-site scripting attacks

CVE-2020-26067

Summary

A vulnerability exists in the web interface of Cisco Webex Teams, where inadequate validation of usernames can permit authenticated remote attackers to carry out cross-site scripting (XSS) attacks. By creating an account that incorporates malicious HTML or script content, an attacker can join a space with a harmful account name. If successful, this exploitation may allow access to sensitive information stored in the user's browser. Cisco has released software updates to mitigate this issue, and there are no identified workarounds available.

References