CVE-2022-22779low

CVE-2022-22779: low-severity vulnerability in Zoom Video Communications Inc Keybase Client…

Retained exploded messages in Keybase clients for macOS and Windows

Published · Updated

Follow this CVE+ Monitor Keybase Client

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

8Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 3.7epss 0.8%
The Keybase Clients for macOS and Windows before version 5.9.0 fails to properly remove exploded messages initiated by a user. This can occur if the receiving user switches to a non-chat feature and places the host in a sleep state before the sending user explodes the messages. This could lead to disclosure of sensitive information which was meant to be deleted from a user’s filesystem.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected products
Zoom Video Communications Inc · Keybase Client for macOSZoom Video Communications Inc · Keybase Client for Windows
Related CVEs — Zoom Video Communications Inc Keybase Client…

In the same product, most dangerous first.

CVE-2021-34422HIGHPath traversal of file names in Keybase Client for WindowsEPSS 1.4%CVE-2021-34426MEDIUMArbitrary command execution in Keybase Client for WindowsEPSS 0.2%