Vulnerability Details : CVE-2023-22880
Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5 and Zoom VDI for Windows clients before 5.13.1 contain an information disclosure vulnerability. A recent update to the Microsoft Edge WebView2 runtime used by the affected Zoom clients, transmitted text to Microsoft’s online Spellcheck service instead of the local Windows Spellcheck. Updating Zoom remediates this vulnerability by disabling the feature. Updating Microsoft Edge WebView2 Runtime to at least version 109.0.1481.0 and restarting Zoom remediates this vulnerability by updating Microsoft’s telemetry behavior.
Vulnerability category: Information leak
Products affected by CVE-2023-22880
- cpe:2.3:a:zoom:zoom:*:*:*:*:*:windows:*:*
- cpe:2.3:a:zoom:rooms:*:*:*:*:*:windows:*:*
- cpe:2.3:a:zoom:virtual_desktop_infrastructure:*:*:*:*:*:windows:*:*
Exploit prediction scoring system (EPSS) score for CVE-2023-22880
0.39%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 57 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2023-22880
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST | |
|
6.8
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N |
2.3
|
4.0
|
Zoom Video Communications, Inc. |
CWE ids for CVE-2023-22880
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: security@zoom.us (Secondary)
References for CVE-2023-22880
-
https://explore.zoom.us/en/trust/security/security-bulletin/
Security Bulletin - ZoomVendor Advisory
Jump to