CVE-2022-20917

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-09-15 · updated 2026-06-17
Weakness: CWE-668

Description

A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) message processing feature of Cisco Jabber could allow an authenticated, remote attacker to manipulate the content of XMPP messages that are used by the affected application. This vulnerability is due to the improper handling of nested XMPP messages within requests that are sent to the Cisco Jabber client software. An attacker could exploit this vulnerability by connecting to an XMPP messaging server and sending crafted XMPP messages to an affected Jabber client. A successful exploit could allow the attacker to manipulate the content of XMPP messages, possibly allowing the attacker to cause the Jabber client application to perform unsafe actions.

Affected products

Cisco Jabber: before 12.6.6; before 12.8.8; before 14.1.4; from 12.7 before 12.7.6; from 12.8 before 12.8.7; from 12.9 before 12.9.7 — fixed in 12.6.6, 12.7.6, 12.8.7, 12.8.8, 12.9.7, 12.9.8

How to fix

Upgrade to a fixed version: Cisco Jabber 12.6.6, 12.7.6, 12.8.7, 12.8.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-20917 or the next vulnerability affects your stack