Lucene search

ZoomCVE-2023-28599

HistoryJun 13, 2023 - 5:15 p.m.

CVE-2023-28599

2023-06-1317:15:14

CWE-74

CWE-79

Zoom

web.nvd.nist.gov

cve-2023-28599

zoom

html injection

security vulnerability

meeting creation

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

18.6%

JSON

Zoom clients prior to 5.13.10 contain an HTML injection vulnerability. A malicious user could inject HTML into their display name potentially leading a victim to a malicious website during meeting creation.

Affected configurations

Nvd

Node

zoomzoomRange<5.13.10android

zoomzoomRange<5.13.10iphone_os

zoomzoomRange<5.13.10linux

zoomzoomRange<5.13.10macos

zoomzoomRange<5.13.10windows

VendorProductVersionCPE
zoomzoom*cpe:2.3:a:zoom:zoom:*:*:*:*:*:android:*:*
zoomzoom*cpe:2.3:a:zoom:zoom:*:*:*:*:*:iphone_os:*:*
zoomzoom*cpe:2.3:a:zoom:zoom:*:*:*:*:*:linux:*:*
zoomzoom*cpe:2.3:a:zoom:zoom:*:*:*:*:*:macos:*:*
zoomzoom*cpe:2.3:a:zoom:zoom:*:*:*:*:*:windows:*:*

Vendor	Product	Version	CPE
zoom	zoom	*	cpe:2.3:a:zoom:zoom::::::android::*
zoom	zoom	*	cpe:2.3:a:zoom:zoom::::::iphone_os::*
zoom	zoom	*	cpe:2.3:a:zoom:zoom::::::linux::*
zoom	zoom	*	cpe:2.3:a:zoom:zoom::::::macos::*
zoom	zoom	*	cpe:2.3:a:zoom:zoom::::::windows::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Zoom for Android",
    "vendor": "Zoom Video Communications, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "before 5.13.10"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Zoom for iOS",
    "vendor": "Zoom Video Communications, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "before 5.13.10"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Zoom for Linux",
    "vendor": "Zoom Video Communications, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "before 5.13.10"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Zoom for macOS",
    "vendor": "Zoom Video Communications, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "before 5.13.10"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Zoom for Windows",
    "vendor": "Zoom Video Communications, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "before 5.13.10"
      }
    ]
  }
]

References

explore.zoom.us/en/trust/security/security-bulletin/

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

AI Score

Confidence

High

EPSS

0.001

Percentile

18.6%

JSON

Related for CVE-2023-28599