8.8

CVE-2023-43582

Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access.

Data is provided by the National Vulnerability Database (NVD)
Zoom ≫ Meetings SwPlatformandroid Version < 5.16.0
Zoom ≫ Meetings SwPlatformiphone_os Version < 5.16.0
Zoom ≫ Meetings SwPlatformlinux Version < 5.16.0
Zoom ≫ Meetings SwPlatformmacos Version < 5.16.0
Zoom ≫ Meetings SwPlatformwindows Version < 5.16.0
Zoom ≫ Rooms SwPlatformandroid Version < 5.16.0
Zoom ≫ Rooms SwPlatformipad_os Version < 5.16.0
Zoom ≫ Rooms SwPlatformmacos Version < 5.16.0
Zoom ≫ Rooms SwPlatformwindows Version < 5.16.0
Zoom ≫ Virtual Desktop Infrastructure Version < 5.14.13
Zoom ≫ Virtual Desktop Infrastructure Version >= 5.15.0 < 5.15.11
Zoom ≫ Zoom SwPlatformandroid Version < 5.16.0
Zoom ≫ Zoom SwPlatformiphone_os Version < 5.16.0
Zoom ≫ Zoom SwPlatformlinux Version < 5.16.0
Zoom ≫ Zoom SwPlatformmacos Version < 5.16.0
Zoom ≫ Zoom SwPlatformwindows Version < 5.16.0
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.16% 0.383
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
security@zoom.us 5.5 2.1 3.4
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CWE-287 Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

CWE-939 Improper Authorization in Handler for Custom URL Scheme

The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.