Lucene search

[email protected]CVE-2023-22880

HistoryMar 16, 2023 - 9:15 p.m.

CVE-2023-22880

2023-03-1621:15:12

CWE-200

[email protected]

web.nvd.nist.gov

cve

zoom

windows

vulnerability

information disclosure

microsoft edge

webview2

microsoft

spellcheck

update

nvd

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

7 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

49.1%

JSON

Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an information disclosure vulnerability. A recent update to the Microsoft Edge WebView2 runtime used by the affected Zoom clients, transmitted text to Microsoft’s online Spellcheck service instead of the local Windows Spellcheck. Updating Zoom remediates this vulnerability by disabling the feature. Updating Microsoft Edge WebView2 Runtime to at least version 109.0.1481.0 and restarting Zoom remediates this vulnerability by updating Microsoft’s telemetry behavior.

Affected configurations

NVD

Node

zoomroomsRange<5.13.3windows

zoomvirtual_desktop_infrastructureRange<5.13.1windows

zoomzoomRange<5.13.3windows

CPENameOperatorVersion
zoom:roomszoom roomslt5.13.3
zoom:virtual_desktop_infrastructurezoom virtual desktop infrastructurelt5.13.1
zoom:zoomzoomlt5.13.3

CPE	Name	Operator	Version
zoom:rooms	zoom rooms	lt	5.13.3
zoom:virtual_desktop_infrastructure	zoom virtual desktop infrastructure	lt	5.13.1
zoom:zoom	zoom	lt	5.13.3

CNA Affected

[
  {
    "vendor": "Zoom Video Communications Inc",
    "product": "Zoom for Windows",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "5.13.3",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Zoom Video Communications Inc",
    "product": "Zoom Rooms for Windows",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "5.13.3",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  },
  {
    "vendor": "Zoom Video Communications Inc",
    "product": "Zoom VDI for Windows",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "5.13.1",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]