Cleartext transmission of sensitive information in Zoom Video Communications, Inc. products - CVE-2023-36539

Vulnerability identifier: #VU77820

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-36539

CWE-ID: CWE-319

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to software did not use a per-meeting key to encrypt messages sent between user devices and Zoom, including messages sent during End-to-End Encrypted (E2EE) meetings.A remote attacker with ability to intercept and decrypt TLS communication can gain access to sensitive information.

Zoom Rooms Client for Windows
Zoom Rooms Client for macOS
Zoom Workplace Desktop App for Linux
Zoom Workplace Desktop App for Windows
Zoom Workplace Desktop App for macOS
Zoom Workplace App for iOS
Zoom Workplace App for Android
Zoom Meeting SDK for Windows

Install updates from vendor's website.

Zoom Rooms Client for Windows - update to 5.15.1 2993
Zoom Rooms Client for macOS - update to 5.15.1 3602
Zoom Workplace Desktop App for Linux - update to 5.15.2 4260
Zoom Workplace App for iOS - update to 5.15.2 8833
Zoom Workplace App for Android - update to 5.15.2 14613
Zoom Workplace Desktop App for Windows - update to 5.15.2 18096
Zoom Workplace Desktop App for macOS - update to 5.15.2 19786
Zoom Meeting SDK for Windows - update to 5.15.2

• https://explore.zoom.us/en/trust/security/security-bulletin/#ZSB-23025

• Information disclosure in multiple Zoom products