Search/CVE-2023-22880
● CVE — Medium

CVE-2023-22880

VendorzoomProductzoom, rooms, virtual desktop infrastructureDiscoveredMar 16, 2023UpdatedNov 21, 2024

Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an information disclosure vulnerability. A recent update to the Microsoft Edge WebView2 runtime used by the affected Zoom clients, transmitted text to Microsoft’s online Spellcheck service instead of the local Windows Spellcheck. Updating Zoom remediates this vulnerability by disabling the feature. Updating Microsoft Edge WebView2 Runtime to at least version 109.0.1481.0 and restarting Zoom remediates this vulnerability by updating Microsoft’s telemetry behavior.

CVSS v3.1
6.8 MEDIUM
EPSS
0.98%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionREQUIRED
ScopeCHANGED
ConfidentialityHIGH
IntegrityNONE
AvailabilityNONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Connections
4 relationships
Timeline
disclosure → media coverage
Mar 16, 2023
Disclosure — published as a CVE record. · last revised by NVD Nov 21, 2024