Jabber For Android
Monthly
Path traversal in Cisco Jabber for Android (com.cisco.im) before 15.3.1.311364 lets a locally installed malicious app with no requested permissions write attacker-controlled files into Jabber's private application data directories. The attacker sends a crafted shared content:// URI to Jabber's exported crosslaunch.share activity whose unsanitized ContentProvider display name contains '../' sequences; because that display name is used directly in file-path construction, files can be planted in databases/, shared_prefs/, no_backup/, and files/ with no user interaction. Impact is integrity-only and confined to Jabber's own sandbox (CVSS v4.0 5.1, AV:L/PR:N/UI:N/VC:N/VI:L/VA:N); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the attack surface is local - the adversary must already have code executing on the device.
Path traversal in Cisco Jabber for Android (com.cisco.im) before 15.3.1.311364 lets a locally installed malicious app with no requested permissions write attacker-controlled files into Jabber's private application data directories. The attacker sends a crafted shared content:// URI to Jabber's exported crosslaunch.share activity whose unsanitized ContentProvider display name contains '../' sequences; because that display name is used directly in file-path construction, files can be planted in databases/, shared_prefs/, no_backup/, and files/ with no user interaction. Impact is integrity-only and confined to Jabber's own sandbox (CVSS v4.0 5.1, AV:L/PR:N/UI:N/VC:N/VI:L/VA:N); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the attack surface is local - the adversary must already have code executing on the device.