CVE-2023-28597

CVSS V2 None CVSS V3 None

Description

Zoom clients prior to 5.13.5 contain an improper trust boundary implementation vulnerability. If a victim saves a local recording to an SMB location and later opens it using a link from Zoom’s web portal, an attacker positioned on an adjacent network to the victim client could set up a malicious SMB server to respond to client requests, causing the client to execute attacker controlled executables. This could result in an attacker gaining access to a user's device and data, and remote code execution.

Overview

CVE ID
CVE-2023-28597

Assigner
security@zoom.us

Vulnerability Status
Analyzed

Published Version
2023-03-27T21:15:12

Last Modified Date
2023-04-03T14:22:09

Weakness Enumerations

CWE	URL
NVD-CWE-noinfo	http://cwe.mitre.org/data/definitions/NVD-noinfo.html
CWE-501	http://cwe.mitre.org/data/definitions/501.html

CPE Configuration (Product)

CPE	Vulnerable	Operator	Version End
		AND
cpe:2.3:a:zoom:rooms::::::android::*	1	OR	5.13.5
cpe:2.3:a:zoom:rooms::::::iphone_os::*	1	OR	5.13.5
cpe:2.3:a:zoom:rooms::::::linux_kernel::*	1	OR	5.13.5
cpe:2.3:a:zoom:rooms::::::macos::*	1	OR	5.13.5
cpe:2.3:a:zoom:rooms::::::windows::*	1	OR	5.13.5
cpe:2.3:a:zoom:zoom::::::android::*	1	OR	5.13.5
cpe:2.3:a:zoom:zoom::::::iphone_os::*	1	OR	5.13.5
cpe:2.3:a:zoom:zoom::::::linux_kernel::*	1	OR	5.13.5
cpe:2.3:a:zoom:zoom::::::macos::*	1	OR	5.13.5
cpe:2.3:a:zoom:zoom::::::windows::*	1	OR	5.13.5
		AND
cpe:2.3:a:zoom:virtual_desktop_infrastructure::::::::	1	OR	5.13.10
cpe:2.3:o:microsoft:windows:-:::::::*	0	OR

References

Reference URL	Reference Tags
https://explore.zoom.us/en/trust/security/security-bulletin/	Vendor Advisory

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-28597
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-28597

History

Created	Old Value	New Value	Data Type	Notes
2023-04-17 03:35:15				Added to TrackCVE
2023-04-17 03:35:18			Weakness Enumeration	new