Information disclosure in Cisco Jabber
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.
Summary
A vulnerability in Cisco Jabber for Windows could allow an unauthenticated, local attacker to access sensitive communications made by the Jabber client. An attacker could exploit this vulnerability to gain information to conduct additional attacks. The vulnerability is due to the way Cisco Jabber for Windows handles random number generation for file folders. An attacker could exploit the vulnerability by fixing the random number data used to establish Secure Sockets Layer (SSL) connections between clients. An exploit could allow the attacker to decrypt secure communications made by the Cisco Jabber for Windows client. Cisco Bug IDs: CSCve44806.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Cisco Jabber | Cisco Jabber | — | No fix listed | CNA |
- Cisco Jabber Vendor— Affected Cisco Jabber Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:cisco:jabber:11.8\(0\):*:*:*:*:windows:*:* | 11.8(0) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:jabber:11.8\(1\):*:*:*:*:windows:*:* | 11.8(1) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:jabber:11.8\(2\):*:*:*:*:windows:*:* | 11.8(2) | Vulnerable | Cisco |
| cpe:2.3:a:cisco:jabber:11.8\(3\):*:*:*:*:windows:*:* | 11.8(3) | Vulnerable | Cisco |
- cpe:2.3:a:cisco:jabber:11.8\(0\):*:*:*:*:windows:*:* Versions 11.8(0) Vulnerable ·Cisco
- cpe:2.3:a:cisco:jabber:11.8\(1\):*:*:*:*:windows:*:* Versions 11.8(1) Vulnerable ·Cisco
- cpe:2.3:a:cisco:jabber:11.8\(2\):*:*:*:*:windows:*:* Versions 11.8(2) Vulnerable ·Cisco
- cpe:2.3:a:cisco:jabber:11.8\(3\):*:*:*:*:windows:*:* Versions 11.8(3) Vulnerable ·Cisco
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-12361
- 2026-10-03 Alias added: GHSA-4998-58vc-p397
References
More Cisco Jabber vulnerabilities
- TI-2020-03041 Cisco Jabber for Windows Message Handling Arbitrary Code Execution Vulnerability CVSS 3.1CRITICAL 9.9
- TI-2020-15937 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities CVSS 3.1CRITICAL 9.9
- TI-2020-02979 Cisco Jabber for Windows Protocol Handler Command Injection Vulnerability CVSS 3.1HIGH 8.8
- TI-2021-01198 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities CVSS 3.1CRITICAL 9.9
- TI-2021-01138 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities CVSS 3.1CRITICAL 9.9
- TI-2020-16496 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities CVSS 3.1CRITICAL 9.9
Sources
- CVE-2017-12361 · CVE Program
- CVE-2017-12361 · NVD
- FIRST EPSS
- GHSA-4998-58vc-p397 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences