CVE-2023-36535: high-severity vulnerability in Zoom Clients
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Zoom clients before version 5.14.10 have a security flaw where the application trusts client-side checks instead of properly enforcing security rules on the server side. An authenticated user could exploit this to access information they shouldn't be able to see by manipulating their local application.
CWE-449 vulnerability in Zoom clients <5.14.10 where security decisions are enforced on the client rather than the server. An authenticated attacker can bypass client-side restrictions through network manipulation or application modification, resulting in unauthorized information disclosure without requiring additional authentication or privileges.
In the same product, most dangerous first.