Lucene search

[email protected]CVE-2023-39218

HistoryAug 08, 2023 - 6:15 p.m.

CVE-2023-39218

2023-08-0818:15:23

CWE-602

[email protected]

web.nvd.nist.gov

cve-2023-39218

zoom

security

information disclosure

network access

privileged user

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N

5.3 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.2%

JSON

Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow a privileged user to enable information disclosure via network access.

Affected configurations

NVD

Node

zoomroomsRange<5.14.10android

zoomroomsRange<5.14.10ipad_os

zoomroomsRange<5.14.10macos

zoomroomsRange<5.14.10windows

zoomvirtual_desktop_infrastructureRange<5.14.10

zoomzoomRange<5.14.10android

zoomzoomRange<5.14.10iphone_os

zoomzoomRange<5.14.10linux

zoomzoomRange<5.14.10macos

zoomzoomRange<5.14.10windows

CPENameOperatorVersion
zoom:roomszoom roomslt5.14.10
zoom:virtual_desktop_infrastructurezoom virtual desktop infrastructurelt5.14.10
zoom:zoomzoomlt5.14.10

CPE	Name	Operator	Version
zoom:rooms	zoom rooms	lt	5.14.10
zoom:virtual_desktop_infrastructure	zoom virtual desktop infrastructure	lt	5.14.10
zoom:zoom	zoom	lt	5.14.10

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Zoom Clients",
    "vendor": "Zoom Video Communications, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "before 5.14.10"
      }
    ]
  }
]