DATABASE RESOURCES PRICING ABOUT US

{"id": "PACKETSTORM:161897", "type": "packetstorm", "bulletinFamily": "exploit", "title": "Zoom 5.4.3 (54779.1115) / 5.5.4 (13142.0301) Information Disclosure", "description": "", "published": "2021-03-22T00:00:00", "modified": "2021-03-22T00:00:00", "cvss": {"score": 0.0, "vector": "NONE"}, "href": "https://packetstormsecurity.com/files/161897/Zoom-5.4.3-54779.1115-5.5.4-13142.0301-Information-Disclosure.html", "reporter": "Matthias Deeg", "references": [], "cvelist": ["CVE-2021-28133"], "lastseen": "2021-03-22T15:33:43", "viewCount": 331, "enchantments": {"dependencies": {"references": [{"type": "cve", "idList": ["CVE-2021-28133"]}, {"type": "thn", "idList": ["THN:3684CE08BD3E629CE1245D3AE600F65D"]}, {"type": "threatpost", "idList": ["THREATPOST:27F1252150B07A7ECB8867B962FA77D0"]}, {"type": "zdt", "idList": ["1337DAY-ID-36009"]}], "rev": 4}, "score": {"value": 3.6, "vector": "NONE"}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2021-28133"]}, {"type": "thn", "idList": ["THN:3684CE08BD3E629CE1245D3AE600F65D"]}, {"type": "threatpost", "idList": ["THREATPOST:27F1252150B07A7ECB8867B962FA77D0"]}, {"type": "zdt", "idList": ["1337DAY-ID-36009"]}]}, "exploitation": null, "vulnersScore": 3.6}, "sourceHref": "https://packetstormsecurity.com/files/download/161897/SYSS-2020-044.txt", "sourceData": "`Advisory ID: SYSS-2020-044 \nProduct: Zoom \nManufacturer: Zoom Video Communications, Inc. \nAffected Version(s): 5.4.3 (54779.1115) \n5.5.4 (13142.0301) \nTested Version(s): 5.4.3 (54779.1115) \n5.5.4 (13142.0301) \nVulnerability Type: Exposure of Resource to Wrong Sphere (CWE-668) \nRisk Level: Medium \nSolution Status: Open \nManufacturer Notification: 2020-12-02 \nSolution Date: - \nPublic Disclosure: 2021-03-18 \nCVE Reference: CVE-2021-28133 \nAuthors of Advisory: Michael Strametz, Matthias Deeg \n \n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ \n \nOverview: \n \nZoom is a video conferencing and messaging software with support for \nmany different devices. \n \nSome of the supported features as described by the manufacturer are \n(see [1]): \n \n\" \n* Unparalleled usability \nEnable quick adoption with meeting capabilities that make it easy to \nstart, join, and collaborate across any device. \n \n* Join anywhere, on any device \nZoom Meetings syncs with your calendar system and delivers streamlined \nenterprise-grade video conferencing from desktop and mobile. \n \n* Powerful meeting security \nRobust security settings ensure disruption-free meetings. Encryption, \nrole-based security, Passcode protection, Waiting Rooms and more. \n\" \n \nDue to a security issue concerning the \"share screen\" functionality, \nscreen contents of applications which are not explicitly shared by the \nscreen-sharing user can be seen by other meeting participants. \n \n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ \n \nVulnerability Details: \n \nWhen a Zoom user shares a specific application window via the \"share \nscreen\" functionality, other meeting participants can briefly see \ncontents of other application windows which were not explicitly shared. \n \nThe contents of not shared application windows can, for instance, be seen \nfor a short period of time by other users when those windows overlay the \nshared application window and get into focus. \n \nDepending on the unintentionally shared data, this short exposure of \nscreen contents may be a more or less severe security issue. \n \nA participant of a Zoom meeting recording a meeting using a screen \nrecorder software may afterwards have access to sensitive data of \nother users which is accessible in a few frames of the recorded video. \n \n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ \n \nProof of Concept (PoC): \n \nSySS could successfully demonstrate the described attack concerning \nscreen recordings of Zoom meetings with unintentionally shared screen \ncontents both using the current Windows and Linux Zoom client software. \n \nIn this attack scenario, the two users Alice and Mallory are in the \nsame Zoom meeting and Alice shares her web browser window via the \"share \nscreen\" functionality. \n \nMallory records her whole desktop screen using a screen recorder \nsoftware, for instance SimpleScreenRecorder [3]. \n \nBetween showing different things in her shared web browser window, Alice \nuses another application whose application window happens to overlay \nthe shared web browser window. \n \nThe contents of this other application window, which is explicitly not \nshared with Mallory, can sometimes briefly be seen by Mallory. \n \nWhen watching the created screen recording, Mallory can pause the video \nat will and thus see the unintentionally shared application window \ncontents from Alice. \n \nA SySS proof of concept video illustrating this security issue is \navailable on our SySS Pentest TV YouTube channel [5]. \n \n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ \n \nSolution: \n \nSySS GmbH is not aware of a fix for the described security issue. \nPlease contact the software manufacturer for further information. \n \n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ \n \nDisclosure Timeline: \n \n2020-12-02: Vulnerability reported to manufacturer \n2020-12-02: Manufacturer acknowledges receipt of security advisory \n2020-12-02: Manufacturer asks for more information \n2020-12-03: SySS provides more information concerning the security issue \n2020-12-03: Manufacturer confirms reproducing the security issue in both \nthe Windows and the Linux client and asks further questions \n2020-12-04: SySS answers open questions \n2020-12-04: Manufacturer responds and will look into the reported \nsecurity issue \n2021-01-21: SySS asks for status update \n2021-02-01: SySS asks for status update \n2021-03-18: Public release of security advisory \n \n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ \n \nReferences: \n \n[1] Product Website for Zoom \nhttps://zoom.us/ \n[2] SySS Security Advisory SYSS-2020-044 \n \nhttps://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-044.txt \n[3] SySS GmbH, SySS Responsible Disclosure Policy \nhttps://www.syss.de/en/responsible-disclosure-policy \n[4] GitHub Website of SimpleScreenRecorder \nhttps://github.com/MaartenBaert/ssr/ \n[5] SySS Proof of Concept Video: Zoom Unintended Screen Sharing Issue \nhttps://www.youtube.com/watch?v=SonmmgQlLzg \n \n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ \n \nCredits: \n \nThis security vulnerability was found by Michael Strametz of SySS Cyber \nSecurity GmbH (Austria) and Matthias Deeg of SySS GmbH. \n \nE-Mail: michael.strametz@syss.de \nPublic Key: \nhttps://www.syss.de/fileadmin/dokumente/PGPKeys/Michael_Strametz.asc \nKey Fingerprint: AD50 E8B8 4E6E 5E00 F45F CE35 744F A11A 2EAC 214D \n \nE-Mail: matthias.deeg (at) syss.de \nPublic Key: \nhttps://www.syss.de/fileadmin/dokumente/Materialien/PGPKeys/Matthias_Deeg.asc \nKey fingerprint = D1F0 A035 F06C E675 CDB9 0514 D9A4 BF6A 34AD 4DAB \n \n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ \n \nDisclaimer: \n \nThe information provided in this security advisory is provided \"as is\" \nand without warranty of any kind. Details of this security advisory may \nbe updated in order to provide as accurate information as possible. The \nlatest version of this security advisory is available on the SySS website. \n \n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ \n \nCopyright: \n \nCreative Commons - Attribution (by) - Version 3.0 \nURL: http://creativecommons.org/licenses/by/3.0/deed.en \n \n \n \n`\n", "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1646213270}}

{"threatpost": [{"lastseen": "2021-03-19T13:53:09", "description": "A security blip in the current version of Zoom could inadvertently leak users\u2019 data to other meeting participants on a call. However, the data is only leaked briefly, making a potential attack difficult to carry out.\n\nThe flaw ([CVE-2021-28133](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28133>)) stems from a glitch in the screen sharing function of video conferencing platform Zoom. This function allows users to share the contents of their screen with other participants in a Zoom conferencing call. They have the option to share their entire screen, one or more application windows or just one selected area of their screen.\n\nHowever, \u201cunder certain conditions\u201d if a Zoom presenter chooses to share one application window, the share-screen feature briefly transmits content of other application windows to meeting participants, according to German-based SySS security consultant Michael Strametz, who discovered the flaw, and researcher Matthias Deeg, in a [Thursday disclosure advisory](<https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-044.txt>) (which has been translated via Google).\n\n[](<https://threatpost.com/newsletter-sign/>)\n\n\u201cThe impact in real-life situations would be sharing confidential data in an unintended way to unauthorized people,\u201d Deeg told Threatpost.\n\nThe current Zoom client version, [5.5.4 (13142.0301)](<https://support.zoom.us/hc/en-us/articles/201361953-New-updates-for-Windows>), for Windows is still vulnerable to the issue, Deeg told Threatpost.\n\nThe issue occurs in a \u201creliably reproducible manner\u201d when a user shares one split application window (such as presentation slides in a web browser) while opening other applications (such as a mail client) in the background, in what is supposed to be in non-shared mode. Researchers found, the contents of the explicitly non-shared application window can be perceived for a \u201cbrief moment\u201d by meeting participants.\n\nWhile this would only occur briefly, researchers warn that other meeting participants who are recording the Zoom meeting (either through Zoom\u2019s built-in recording capabilities or via screen recording software like SimpleScreenRecorder) are able to then go back to the recording and fully view any potentially sensitive data leaked through that transmission.\n\nBecause this bug would be difficult to actually intentionally exploit (an attacker would need to be a participant in a meeting where data is inadvertently leaked by the bug) the flaw is only medium-severity (5.7 out of 10) on the CVSS scale.\n\nHowever, \u201cthe severity of this issue really depends on the unintended shared data,\u201d Deeg told Threatpost. \u201cIn some cases, it doesn\u2019t matter, in other cases, it may cause more trouble.\u201d\n\nFor instance, if a conference or webinar panelist was presenting slides to attendees via Zoom, and then opened a password manager or email application in the background, other Zoom participants would be able to access this information.\n\nA [proof-of-concept video](<https://www.youtube.com/watch?v=SonmmgQlLzg&feature=emb_title>) of the attack is below:\n\nThe vulnerability was reported to Zoom on Dec. 2 \u2013 however, as of the date of public disclosure of the flaw, on Thursday, researchers said they are \u201cnot aware of a fix\u201d despite several inquiries for status updates from Zoom.\n\n\u201cUnfortunately, our questions concerning status updates on January 21 and February 1, 2021, remained unanswered,\u201d Deeg told Threatpost. \u201cI hope that Zoom will soon fix this issue and my only advice for all Zoom users\u2026 is to be careful when using the screen sharing functionality and [to follow a] strict \u2018clean virtual desktop\u2019 policy during Zoom meetings.\u201d\n\nThreatpost has reached out to Zoom for further comment regarding the flaw, and whether it will be fixed in the upcoming release [that\u2019s scheduled to go live March 22](<https://support.zoom.us/hc/en-us/articles/201361953-New-updates-for-Windows>).\n\n\u201cZoom takes all reports of security vulnerabilities seriously,\u201d a Zoom spokesperson told Threatpost. \u201cWe are aware of this issue, and are working to resolve it.\u201d\n\nWith the [coronavirus pandemic](<https://threatpost.com/wiper-malware-coronavirus-windows-victims/154368/>) driving more organizations to \u201cflatten the curve\u201d by [going remote](<https://threatpost.com/working-from-home-covid-19s-constellation-of-security-challenges/153720/>) over the past year \u2013 and thus various web conferencing platforms \u2013 Zoom has been grappling with various security and privacy issues, including attackers [hijacking online meetings](<https://threatpost.com/fbi-threatens-zoom-bombing-trolls-with-jail-time/154495/>) in what are called [Zoom bombing](<https://threatpost.com/as-zoom-booms-incidents-of-zoombombing-become-a-growing-nuisance/154187/>) attacks. Other security issues have come to light in Zoom\u2019s platform over the past year \u2013 such as one that could have allowed attackers to [crack private meeting passcodes](<https://threatpost.com/zoom-flaw-could-have-allowed-hackers-to-crack-meeting-passcodes/157883/>) and snoop in on video conferences. However, Zoom has also taken important steps to secure its conferencing platform, including [beefing up its end-to-end encryption](<https://threatpost.com/zoom-acquires-keybase-encryption/155557/>) and [implementing other security measures](<https://threatpost.com/zoom-bombers-ftc-settlement/161312/>).\n\n**_[Register for this LIVE Event](<https://threatpost.com/webinars/economics-of-0-day-disclosures-the-good-bad-and-ugly/>)_****_: 0-Day Disclosures: Good, Bad &amp; Ugly:_** **_On Mar. 24 at 2 p.m. ET_**_, Threatpost_ tackles how vulnerability disclosures can pose a risk to companies. To be discussed, Microsoft 0-days found in Exchange Servers. Join 0-day hunters from Intel Corp. and veteran bug bounty researchers who will untangle the 0-day economy and unpack what\u2019s on the line for all businesses when it comes to the disclosure process. [Register NOW](<https://threatpost.com/webinars/economics-of-0-day-disclosures-the-good-bad-and-ugly/>) for this **LIVE **webinar on Wed., Mar. 24.\n", "cvss3": {}, "published": "2021-03-18T15:52:29", "type": "threatpost", "title": "Zoom Screen-Sharing Glitch \u2018Briefly\u2019 Leaks Sensitive Data", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2021-28133"], "modified": "2021-03-18T15:52:29", "id": "THREATPOST:27F1252150B07A7ECB8867B962FA77D0", "href": "https://threatpost.com/zoom-glitch-leaks-data/164876/", "cvss": {"score": 0.0, "vector": "NONE"}}], "zdt": [{"lastseen": "2021-09-30T22:26:18", "description": "", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 1.4}, "published": "2021-03-22T00:00:00", "type": "zdt", "title": "Zoom 5.4.3 (54779.1115) / 5.5.4 (13142.0301) Information Disclosure Vulnerability", "bulletinFamily": "exploit", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-28133"], "modified": "2021-03-22T00:00:00", "id": "1337DAY-ID-36009", "href": "https://0day.today/exploit/description/36009", "sourceData": "Manufacturer: Zoom Video Communications, Inc.\r\nAffected Version(s): 5.4.3 (54779.1115)\r\n 5.5.4 (13142.0301)\r\nTested Version(s): 5.4.3 (54779.1115)\r\n 5.5.4 (13142.0301)\r\nVulnerability Type: Exposure of Resource to Wrong Sphere (CWE-668)\r\nRisk Level: Medium\r\nSolution Status: Open\r\nManufacturer Notification: 2020-12-02\r\nSolution Date: -\r\nPublic Disclosure: 2021-03-18\r\nCVE Reference: CVE-2021-28133\r\nAuthors of Advisory: Michael Strametz, Matthias Deeg\r\n\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nOverview:\r\n\r\nZoom is a video conferencing and messaging software with support for\r\nmany different devices.\r\n\r\nSome of the supported features as described by the manufacturer are\r\n(see [1]):\r\n\r\n\"\r\n* Unparalleled usability\r\n Enable quick adoption with meeting capabilities that make it easy to\r\n start, join, and collaborate across any device.\r\n\r\n* Join anywhere, on any device\r\n Zoom Meetings syncs with your calendar system and delivers streamlined\r\n enterprise-grade video conferencing from desktop and mobile.\r\n\r\n* Powerful meeting security\r\n Robust security settings ensure disruption-free meetings. Encryption,\r\n role-based security, Passcode protection, Waiting Rooms and more.\r\n\"\r\n\r\nDue to a security issue concerning the \"share screen\" functionality,\r\nscreen contents of applications which are not explicitly shared by the\r\nscreen-sharing user can be seen by other meeting participants.\r\n\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nVulnerability Details:\r\n\r\nWhen a Zoom user shares a specific application window via the \"share\r\nscreen\" functionality, other meeting participants can briefly see\r\ncontents of other application windows which were not explicitly shared.\r\n\r\nThe contents of not shared application windows can, for instance, be seen\r\nfor a short period of time by other users when those windows overlay the\r\nshared application window and get into focus.\r\n\r\nDepending on the unintentionally shared data, this short exposure of\r\nscreen contents may be a more or less severe security issue.\r\n\r\nA participant of a Zoom meeting recording a meeting using a screen\r\nrecorder software may afterwards have access to sensitive data of\r\nother users which is accessible in a few frames of the recorded video.\r\n\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nProof of Concept (PoC):\r\n\r\nSySS could successfully demonstrate the described attack concerning\r\nscreen recordings of Zoom meetings with unintentionally shared screen\r\ncontents both using the current Windows and Linux Zoom client software.\r\n\r\nIn this attack scenario, the two users Alice and Mallory are in the\r\nsame Zoom meeting and Alice shares her web browser window via the \"share\r\nscreen\" functionality.\r\n\r\nMallory records her whole desktop screen using a screen recorder\r\nsoftware, for instance SimpleScreenRecorder [3].\r\n\r\nBetween showing different things in her shared web browser window, Alice\r\nuses another application whose application window happens to overlay\r\nthe shared web browser window.\r\n\r\nThe contents of this other application window, which is explicitly not\r\nshared with Mallory, can sometimes briefly be seen by Mallory.\r\n\r\nWhen watching the created screen recording, Mallory can pause the video\r\nat will and thus see the unintentionally shared application window\r\ncontents from Alice.\r\n\r\nA SySS proof of concept video illustrating this security issue is\r\navailable on our SySS Pentest TV YouTube channel [5].\r\n\r\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\r\nSolution:\r\n\r\nSySS GmbH is not aware of a fix for the described security issue.\r\nPlease contact the software manufacturer for further information.\n\n# 0day.today [2021-10-01] #", "sourceHref": "https://0day.today/exploit/36009", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}], "thn": [{"lastseen": "2022-05-09T12:38:25", "description": "[](<https://thehackernews.com/images/-DYghwYDOitA/YFRI3oyB5dI/AAAAAAAACD4/vlztMF__5qQNqL9RxeylEGvK0CeiCW77ACLcBGAsYHQ/s0/zoom-screen-share.jpg>)\n\nA newly discovered glitch in Zoom's screen sharing feature can accidentally leak sensitive information to other attendees in a call, according to the latest findings.\n\nTracked as [CVE-2021-28133](<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28133>), the unpatched security vulnerability makes it possible to reveal contents of applications that are not shared, but only briefly, thereby making it harder to exploit it in the wild.\n\nIt's worth pointing out that the [screen sharing](<https://support.zoom.us/hc/en-us/articles/201362153-Sharing-your-screen-content-or-second-camera>) functionality in Zoom lets users share an entire desktop or phone screen, or limit sharing to one or more specific applications, or a portion of a screen. The issue stems from the fact that a second application that's overlayed on top of an already shared application can reveal its contents for a short period of time.\n\n\"When a Zoom user shares a specific application window via the 'share screen' functionality, other meeting participants can briefly see contents of other application windows which were not explicitly shared,\" SySS researchers Michael Strametz and Matthias Deeg [noted](<https://www.syss.de/pentest-blog/syss-2020-044-sicherheitsproblem-in-screen-sharing-funktionalitaet-von-zoom-cve-2021-28133>). \"The contents of not shared application windows can, for instance, be seen for a short period of time by other users when those windows overlay the shared application window and get into focus.\"\n\nThe flaw, which was tested on versions 5.4.3 and 5.5.4 across both Windows and Linux clients, is said to have been [disclosed](<https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-044.txt>) to the videoconferencing company on December 2, 2020. The lack of a fix even after three months could be attributed in part to the difficulty in exploiting the vulnerability.\n\nBut nonetheless, this could have serious consequences depending on the nature of the inadvertently shared data, the researchers warned, adding a malicious participant of a Zoom meeting can take advantage of the weakness by making use of a screen capture tool to record the meeting and playback the recording to view the private information.\n\nWhen reached for a response, a Zoom spokesperson said it's working to address the issue. \"Zoom takes all reports of security vulnerabilities seriously,\" the company told The Hacker News via email. \"We are aware of this issue, and are working to resolve it.\"\n\n \n\n\nFound this article interesting? Follow THN on [Facebook](<https://www.facebook.com/thehackernews>), [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 1.4}, "published": "2021-03-19T06:48:00", "type": "thn", "title": "New Zoom Screen-Sharing Bug Lets Other Users Access Restricted Apps", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-28133"], "modified": "2021-03-19T10:48:14", "id": "THN:3684CE08BD3E629CE1245D3AE600F65D", "href": "https://thehackernews.com/2021/03/new-zoom-screen-sharing-bug-lets-other.html", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}], "cve": [{"lastseen": "2022-03-23T16:22:26", "description": "Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the participant never attempted to share the private part of their screen. When a user shares a specific application window via the Share Screen functionality, other meeting participants can briefly see contents of other application windows that were explicitly not shared. The contents of these other windows can (for instance) be seen for a short period of time when they overlay the shared window and get into focus. (An attacker can, of course, use a separate screen-recorder application, unsupported by Zoom, to save all such contents for later replays and analysis.) Depending on the unintentionally shared data, this short exposure of screen contents may be a more or less severe security issue.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 1.4}, "published": "2021-03-18T14:15:00", "type": "cve", "title": "CVE-2021-28133", "cwe": ["CWE-200"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-28133"], "modified": "2021-03-26T13:20:00", "cpe": ["cpe:/a:zoom:zoom:5.5.4"], "id": "CVE-2021-28133", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-28133", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:a:zoom:zoom:5.5.4:*:*:*:*:*:*:*"]}]}