Cisco Webex Teams for iOS Arbitrary File Upload Vulnerability
Cisco · Cisco Webex Teams
A vulnerability in the client application for iOS of Cisco Webex Teams could allow an authenticated, remote attacker to upload arbitrary files within the scope of the iOS application. The vulnerability is due to improper input validation in the client application. An attacker could exploit this vulnerability by sending a malicious file to a targeted user and persuading the user to manually open it. An exploit could allow the attacker to overwrite sensitive application files and eventually cause a denial of service (DoS) condition by foreclosing future access to the system to the targeted user. This vulnerability is fixed in version 3.13.26920.
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 2/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 25 Feb 2019. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
3 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 3Command and ControlTA0011
ImpactTA0040
Detection
0 rules for this CVE · 102 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2019-1689 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Ingress Tool TransferT110587 general rules
- Greenbug Espionage Group Indicatorscriticaltest
- Pandemic Registry Keycriticaltest
- Curl Download And Execute Combinationhightest
- File Download And Execution Via IEExec.EXEhightest
- File Download From IP Based URL Via CertOC.EXEhightest
- File Download Using Notepad++ GUP Utilityhightest
- File Download Via Bitsadmin To A Suspicious Target Folderhightest
- File Download Via Windows Defender MpCmpRun.EXEhightest
Account Access RemovalT15319 general rules
- Azure Kubernetes Service Account Modified or Deletedmediumtest
- Google Cloud Service Account Disabled or Deletedmediumtest
- Group Has Been Deleted Via Groupdelmediumtest
- Okta User Account Locked Outmediumtest
- Remove Account From Domain Admin Groupmediumtest
- User Has Been Deleted Via Userdelmediumtest
- AWS SAML Provider Deletion Activitymediumexperimental
- AWS ElastiCache Security Group Modified or Deletedlowtest
Stored Data ManipulationT1565.0016 general rules
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.