CVE-2023-22880
Last modified
CVE-2023-22880 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an information disclosure vulnerability. A recent update to the Microsoft Edge WebView2 runtime used by the affected Zoom clients, transmitted text to Microsoft’s online Spellcheck service instead of the local Windows Spellcheck. EPSS estimates a 0.98% chance of exploitation in the next 30 days.
Description
Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an information disclosure vulnerability. A recent update to the Microsoft Edge WebView2 runtime used by the affected Zoom clients, transmitted text to Microsoft’s online Spellcheck service instead of the local Windows Spellcheck. Updating Zoom remediates this vulnerability by disabling the feature. Updating Microsoft Edge WebView2 Runtime to at least version 109.0.1481.0 and restarting Zoom remediates this vulnerability by updating Microsoft’s telemetry behavior.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Zoom | Rooms | < 5.13.3 |
| Zoom | Virtual Desktop Infrastructure | < 5.13.1 |
| Zoom | Zoom | < 5.13.3 |
References
- https://explore.zoom.us/en/trust/security/security-bulletin/Vendor Advisory
- https://explore.zoom.us/en/trust/security/security-bulletin/Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-22880?
How severe is CVE-2023-22880?
How do I fix CVE-2023-22880?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-22874IBM MQ Clients 9.2 CD, 9.3 CD, and 9.3 LTS are vulnerable to…5.5
- CVE-2023-22875 IBM QRadar SIEM 7.4 and 7.5copies certificate key files use…7.5
- CVE-2023-22876IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through…6.5
- CVE-2023-22877IBM InfoSphere Information Server 11.7 is potentially vulner…8.8
- CVE-2023-22878IBM InfoSphere Information Server 11.7 stores user credentia…5.5
- CVE-2023-2288The Otter WordPress plugin before 2.2.6 does not sanitize so…8.8
- CVE-2023-22881Zoom clients before version 5.13.5 contain a STUN parsing vu…7.5
- CVE-2023-22882Zoom clients before version 5.13.5 contain a STUN parsing vu…7.5
- CVE-2023-22883Zoom Client for IT Admin Windows installers before version 5…7.8
- CVE-2023-22884Improper Neutralization of Special Elements used in a Comman…9.8
- CVE-2023-22885Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2023-22886Improper Input Validation vulnerability in Apache Software F…8.8
Are you affected by CVE-2023-22880?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST