CVE-2023-28597highCWE-501

CVE-2023-28597: falha de alta gravidade em Zoom (for Android, iOS, Linux, macOS, and…

Improper trust boundary implementation for SMB in Zoom Clients

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Zoom Rooms+ Monitorar Zoom

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.3epss 0.5%
Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later opens it using a link from Zoom’s web portal, an attacker positioned on an adjacent network to the victim client could set up a malicious SMB server to respond to client requests, causing the client to execute attacker controlled executables. This could result in an attacker gaining access to a user's device and data, and remote code execution.
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
Zoom Video Communications Inc · Zoom (for Android, iOS, Linux, macOS, and Windows)Zoom Video Communications Inc · Zoom Rooms (for Android, iOS, Linux, macOS, and Windows)Zoom Video Communications Inc · Zoom VDI for Windows
CVEs relacionadas — Zoom (for Android, iOS, Linux, macOS, and…

No mesmo produto, das mais perigosas para as menos.

CVE-2023-22880MEDIUMInformation Disclosure in Zoom for Windows ClientsEPSS 1.0%