CVE-2023-22880

published 2023-03-16

CVE-2023-22880: Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an…

Priority P3 40 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an information disclosure vulnerability. A recent update to the Microsoft Edge WebView2 runtime used by the affected Zoom clients, transmitted text to Microsoft’s online Spellcheck service instead of the local Windows Spellcheck. Updating Zoom remediates this vulnerability by disabling the feature. Updating Microsoft Edge WebView2 Runtime to at least version 109.0.1481.0 and restarting Zoom remediates this vulnerability by updating Microsoft’s telemetry behavior.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
zoom	rooms	< 5.13.3	5.13.3
zoom	virtual_desktop_infrastructure	< 5.13.1	5.13.1
zoom	zoom	< 5.13.3	5.13.3
zoom_video_communications_inc	zoom_for_windows	>= unspecified < 5.13.3	5.13.3
zoom_video_communications_inc	zoom_rooms_for_windows	>= unspecified < 5.13.3	5.13.3
zoom_video_communications_inc	zoom_vdi_for_windows	>= unspecified < 5.13.1	5.13.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200