CVE-2023-43582: Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access

High severity · published Nov 14, 2023

CVE-2023-43582

Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access

8.8

CVSS

0.7%

EPSS

On KEV

Description

Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.7% · higher than 51% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Zoom Clients · Zoom Video Communications, Inc.

see references · source: vendor

Meetings · Zoom

before 5.16.0; before 5.16.0; before 5.16.0; before 5.16.0; before 5.16.0 · source: NVD

Rooms · Zoom

before 5.16.0; before 5.16.0; before 5.16.0; before 5.16.0 · source: NVD

Virtual Desktop Infrastructure · Zoom

before 5.14.13; 5.15.0 before 5.15.11 · source: NVD

Zoom · Zoom

before 5.16.0; before 5.16.0; before 5.16.0; before 5.16.0; before 5.16.0 · source: NVD

Affected product

Zoom Clients

Zoom Video Communications, Inc.

All Zoom Clients CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2023-43582

CVE.org

https://www.cve.org/CVERecord?id=CVE-2023-43582

Vendor Advisory

https://explore.zoom.us/en/trust/security/security-bulletin/