CVE-2021-28133
CVSS V2 Medium 4.3
CVSS V3 Medium 4.3
Description
Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the participant never attempted to share the private part of their screen. When a user shares a specific application window via the Share Screen functionality, other meeting participants can briefly see contents of other application windows that were explicitly not shared. The contents of these other windows can (for instance) be seen for a short period of time when they overlay the shared window and get into focus. (An attacker can, of course, use a separate screen-recorder application, unsupported by Zoom, to save all such contents for later replays and analysis.) Depending on the unintentionally shared data, this short exposure of screen contents may be a more or less severe security issue.
Overview
- CVE ID
- CVE-2021-28133
- Assigner
- cve@mitre.org
- Vulnerability Status
- Analyzed
- Published Version
- 2021-03-18T14:15:14
- Last Modified Date
- 2021-03-26T13:20:06
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:zoom:zoom:*:*:*:*:*:*:*:* | 1 | OR | 5.5.4 |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:M/Au:N/C:P/I:N/A:N
- Access Vector
- NETWORK
- Access Compatibility
- MEDIUM
- Authentication
- NONE
- Confidentiality Impact
- PARTIAL
- Integrity Impact
- NONE
- Availability Impact
- NONE
- Base Score
- 4.3
- Severity
- MEDIUM
- Exploitability Score
- 8.6
- Impact Score
- 2.9
CVSS Version 3
- Version
- 3.1
- Vector String
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
- Attack Vector
- NETWORK
- Attack Compatibility
- LOW
- Privileges Required
- NONE
- User Interaction
- REQUIRED
- Scope
- UNCHANGED
- Confidentiality Impact
- LOW
- Availability Impact
- NONE
- Base Score
- 4.3
- Base Severity
- MEDIUM
- Exploitability Score
- 2.8
- Impact Score
- 1.4
References
| Reference URL | Reference Tags |
|---|---|
| https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-044.txt | Third Party Advisory |
| https://www.syss.de/pentest-blog/syss-2020-044-sicherheitsproblem-in-screen-sharing-funktionalitaet-von-zoom-cve-2021-28133 | Third Party Advisory |
| https://zoom.us/trust/security/security-bulletin | Vendor Advisory |
| https://www.youtube.com/watch?v=SonmmgQlLzg | Third Party Advisory |
| https://thehackernews.com/2021/03/new-zoom-screen-sharing-bug-lets-other.html | Third Party Advisory |
| http://seclists.org/fulldisclosure/2021/Mar/48 | Third Party Advisory |
| http://packetstormsecurity.com/files/161897/Zoom-5.4.3-54779.1115-5.5.4-13142.0301-Information-Disclosure.html | Third Party Advisory |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2021-28133 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28133 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 07:18:38 | Added to TrackCVE | |||
| 2022-12-05 23:59:11 | 2021-03-18T14:15Z | 2021-03-18T14:15:14 | CVE Published Date | updated |
| 2022-12-05 23:59:11 | 2021-03-26T13:20:06 | CVE Modified Date | updated | |
| 2022-12-05 23:59:11 | Analyzed | Vulnerability Status | updated |