Unsecured Media Retrieval Vulnerability in Cisco Webex App Could Allow Access to Sensitive Session Information

CVE-2024-20395

What is CVE-2024-20395?

A vulnerability exists in the media retrieval feature of Cisco Webex App, which could enable an unauthenticated, adjacent attacker to access sensitive session information. This issue arises from the insecure transmission of requests when the app retrieves embedded media like images. An attacker could exploit this by sending a message containing embedded media stored on a messaging server, targeting specific users. By monitoring network traffic in a privileged position, the attacker may capture session token information from these unsecured requests, potentially allowing for further actions impersonating the targeted user.

References