HTML Injection Vulnerability in Zoom Client
CVE-2023-28599

4.3MEDIUM

Key Information:

Vendor
Zoom Video Communications, Inc.
Status
Zoom For Android
Zoom For iOS
Zoom For Linux
Zoom For Mac OS
Vendor
CVE Published:
13 June 2023

Summary

Zoom clients prior to version 5.13.10 are susceptible to an HTML injection vulnerability. This issue allows a malicious user to inject HTML code into their display name, which, when exploited, can redirect a victim to a malicious website during the creation of meetings. Users should update their Zoom clients to the latest version to mitigate this risk and ensure the integrity of their meetings.

Affected Version(s)

Zoom for Android before 5.13.10

Zoom for iOS before 5.13.10

Zoom for Linux before 5.13.10

References

https://explore.zoom.us/en/trust/security/security-bulletin/

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-28599 : HTML Injection Vulnerability in Zoom Client | SecurityVulnerability.io