Read the docs
TI-2022-05476 Aliases CVE-2022-20917GHSA-qw6v-cqcw-98jc

Exposure of resource to wrong sphere in Cisco Jabber

Priority LOW 22CWE-668Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) message processing feature of Cisco Jabber could allow an authenticated, remote attacker to manipulate the content of XMPP messages that are used by the affected application. This vulnerability is due to the improper handling of nested XMPP messages within requests that are sent to the Cisco Jabber client software. An attacker could exploit this vulnerability by connecting to an XMPP messaging server and sending crafted XMPP messages to an affected Jabber client. A successful exploit could allow the attacker to manipulate the content of XMPP messages, possibly allowing the attacker to cause the Jabber client application to perform unsafe actions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00887 59th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CiscoCisco Jabber10.5(0); 10.5(1); 10.5(2); 10.5(3); 10.5(4); 10.5(5); 10.5(6); 10.6(0); 10.6(1); 10.6(2); 10.6(3); 10.6(4); 10.6(5); 10.6(6); 10.6(7); 10.6(10); 10.6(11); 10.6(12); 10.6(8); 10.6(9); 11.0(0); 11.0(1); 11.0(2); 11.1(0); 11.1(1); 11.1(2); 11.1(3); 11.1(4); 11.5(0); 11.5(1); 11.5(2); 11.5(3); 11.5(4); 11.5(5); 11.5(6); 11.6(0); 11.6(1); 11.6(2); 11.6(3); 11.6(4); 11.7(0); 11.7(1); 11.7(2); 11.8(0); 11.8(1); 11.8(2); 11.8(3); 11.8(4); 11.8(5); 11.9(0); 11.9(1); 11.9(2); 11.9(3); 12.0(0); 12.0(1); 12.1(0); 12.1(1); 12.1(2); 12.1(3); 12.1(4); 12.1(5); 12.5(0); 12.5(1); 12.5(2); 12.5(3); 12.5(4); 12.6(0); 12.6(1); 12.6(2); 12.6(3); 12.6(4); 12.6(5); 12.7(0); 12.7(1); 12.7(2); 12.7(3); 12.7(4); 12.7(5); 12.8(0); 12.8(1); 12.8(2); 12.8(3); 12.8(4); 12.8(5); 12.8(6); 12.8(7); 12.9(0); 12.9(1); 12.9(2); 12.9(3); 12.9(4); 12.9(5); 12.9(6); 8.6(1); 8.6(2); 8.6(3); 8.6(4); 8.6(5); 8.6(6); 8.6(7); 9.0(1); 9.0(2); 9.0(3); 9.0(4); 9.0(5); 9.1(0); 9.1(1); 9.1(2); 9.1(3); 9.1(4); 9.1(5); 9.2(0); 9.2(1); 9.2(2); 9.2(3); 9.2(4); 9.2(5); 9.2(6); 9.2(7); 9.3(1); 9.3(2); 9.5(0); 9.6(0); 9.6(1); 9.6(2); 9.6(3); 9.6(4); 9.7(0); 9.7(1); 9.7(2); 9.7(3); 9.7(4); 9.7(5); 9.7(6); 9.7(7); Jabber For Windows; 14.0(0); 14.0(1); 14.0(2); 14.0(3); 14.0(4); 11.2(0); 11.2(1); 14.1(0); 14.1(1); 14.1(2)—No fix listedCNA
  • Cisco Jabber VendorCisco Affected 10.5(0); 10.5(1); 10.5(2); 10.5(3); 10.5(4); 10.5(5); 10.5(6); 10.6(0); 10.6(1); 10.6(2); 10.6(3); 10.6(4); 10.6(5); 10.6(6); 10.6(7); 10.6(10); 10.6(11); 10.6(12); 10.6(8); 10.6(9); 11.0(0); 11.0(1); 11.0(2); 11.1(0); 11.1(1); 11.1(2); 11.1(3); 11.1(4); 11.5(0); 11.5(1); 11.5(2); 11.5(3); 11.5(4); 11.5(5); 11.5(6); 11.6(0); 11.6(1); 11.6(2); 11.6(3); 11.6(4); 11.7(0); 11.7(1); 11.7(2); 11.8(0); 11.8(1); 11.8(2); 11.8(3); 11.8(4); 11.8(5); 11.9(0); 11.9(1); 11.9(2); 11.9(3); 12.0(0); 12.0(1); 12.1(0); 12.1(1); 12.1(2); 12.1(3); 12.1(4); 12.1(5); 12.5(0); 12.5(1); 12.5(2); 12.5(3); 12.5(4); 12.6(0); 12.6(1); 12.6(2); 12.6(3); 12.6(4); 12.6(5); 12.7(0); 12.7(1); 12.7(2); 12.7(3); 12.7(4); 12.7(5); 12.8(0); 12.8(1); 12.8(2); 12.8(3); 12.8(4); 12.8(5); 12.8(6); 12.8(7); 12.9(0); 12.9(1); 12.9(2); 12.9(3); 12.9(4); 12.9(5); 12.9(6); 8.6(1); 8.6(2); 8.6(3); 8.6(4); 8.6(5); 8.6(6); 8.6(7); 9.0(1); 9.0(2); 9.0(3); 9.0(4); 9.0(5); 9.1(0); 9.1(1); 9.1(2); 9.1(3); 9.1(4); 9.1(5); 9.2(0); 9.2(1); 9.2(2); 9.2(3); 9.2(4); 9.2(5); 9.2(6); 9.2(7); 9.3(1); 9.3(2); 9.5(0); 9.6(0); 9.6(1); 9.6(2); 9.6(3); 9.6(4); 9.7(0); 9.7(1); 9.7(2); 9.7(3); 9.7(4); 9.7(5); 9.7(6); 9.7(7); Jabber For Windows; 14.0(0); 14.0(1); 14.0(2); 14.0(3); 14.0(4); 11.2(0); 11.2(1); 14.1(0); 14.1(1); 14.1(2) Fixed in — No fix listed CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:cisco:jabber:*:*:*:*:*:windows:*:*before 12.6.6VulnerableCisco
cpe:2.3:a:cisco:jabber:*:*:*:*:*:macos:*:*before 12.8.8VulnerableCisco
cpe:2.3:a:cisco:jabber:*:*:*:*:*:android:*:*before 14.1.4VulnerableCisco
cpe:2.3:a:cisco:jabber:*:*:*:*:*:iphone_os:*:*before 14.1.4VulnerableCisco
cpe:2.3:a:cisco:jabber:*:*:*:*:*:windows:*:*12.7 to before 12.7.6; 12.8 to before 12.8.7; 12.9 to before 12.9.7VulnerableCisco
cpe:2.3:a:cisco:jabber:*:*:*:*:*:macos:*:*12.9 to before 12.9.8; 14.0 to before 14.0.5VulnerableCisco
cpe:2.3:a:cisco:jabber:*:*:*:*:*:windows:*:*14.0 to before 14.0.5VulnerableCisco
cpe:2.3:a:cisco:jabber:*:*:*:*:*:macos:*:*14.1 to before 14.1.3VulnerableCisco
cpe:2.3:a:cisco:jabber:*:*:*:*:*:windows:*:*14.1 to before 14.1.3VulnerableCisco
  • cpe:2.3:a:cisco:jabber:*:*:*:*:*:windows:*:* Versions before 12.6.6 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:jabber:*:*:*:*:*:macos:*:* Versions before 12.8.8 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:jabber:*:*:*:*:*:android:*:* Versions before 14.1.4 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:jabber:*:*:*:*:*:iphone_os:*:* Versions before 14.1.4 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:jabber:*:*:*:*:*:windows:*:* Versions 12.7 to before 12.7.6; 12.8 to before 12.8.7; 12.9 to before 12.9.7 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:jabber:*:*:*:*:*:macos:*:* Versions 12.9 to before 12.9.8; 14.0 to before 14.0.5 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:jabber:*:*:*:*:*:windows:*:* Versions 14.0 to before 14.0.5 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:jabber:*:*:*:*:*:macos:*:* Versions 14.1 to before 14.1.3 Vulnerable ·Cisco
  • cpe:2.3:a:cisco:jabber:*:*:*:*:*:windows:*:* Versions 14.1 to before 14.1.3 Vulnerable ·Cisco

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-20917
  2. 2026-10-03 Alias added: GHSA-qw6v-cqcw-98jc

References

Advisory 1

  • TI-2020-03041 Cisco Jabber for Windows Message Handling Arbitrary Code Execution Vulnerability CVSS 3.1CRITICAL 9.9
  • TI-2020-15937 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities CVSS 3.1CRITICAL 9.9
  • TI-2020-02979 Cisco Jabber for Windows Protocol Handler Command Injection Vulnerability CVSS 3.1HIGH 8.8
  • TI-2021-01198 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities CVSS 3.1CRITICAL 9.9
  • TI-2021-01138 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities CVSS 3.1CRITICAL 9.9
  • TI-2020-16496 Cisco Jabber Desktop and Mobile Client Software Vulnerabilities CVSS 3.1CRITICAL 9.9
See all 33 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences