CVE-2023-43585 - Vulnerability Details - OpenCVE

Improper access control in Zoom Mobile App for iOS and Zoom SDKs for iOS before version 5.16.5 may allow an authenticated user to conduct a disclosure of information via network access.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00129.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Zoom Video Communications, Inc.

Zoom Mobile App for iOS and SDKs for iOS

unaffected

Version	Status	Constraints
`before 5.16.0`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:zoom:meeting_software_development_kit::::::android::*
	cpe:2.3:a:zoom:meeting_software_development_kit::::::iphone_os::*
	cpe:2.3:a:zoom:video_software_development_kit::::::iphone_os::*
	cpe:2.3:a:zoom:zoom::::::iphone_os::*

No data.

No data.

Subscriptions

Vendors	Products
Zoom Subscribe	Meeting Software Development Kit Subscribe Video Software Development Kit Subscribe Zoom Subscribe

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
EUVD	EUVD-2023-47991	Improper access control in Zoom Mobile App for iOS and Zoom SDKs for iOS before version 5.16.5 may allow an authenticated user to conduct a disclosure of information via network access.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.zoom.com/en/trust/security-bulletin/ZSB-23058/

History

Fri, 27 Sep 2024 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-284

Fri, 27 Sep 2024 19:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-449

MITRE

Status: PUBLISHED

Assigner: Zoom

Published: 2023-12-13T22:15:58.457Z

Updated: 2024-09-27T19:16:27.688Z

Reserved: 2023-09-19T22:05:40.665Z

Link: CVE-2023-43585

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-12-13T23:15:07.463

Modified: 2024-11-21T08:24:26.730

Link: CVE-2023-43585

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-43585", "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "state": "PUBLISHED", "assignerShortName": "Zoom", "dateReserved": "2023-09-19T22:05:40.665Z", "datePublished": "2023-12-13T22:15:58.457Z", "dateUpdated": "2024-09-27T19:16:27.688Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["iOS"], "product": "Zoom Mobile App for iOS and SDKs for iOS", "vendor": "Zoom Video Communications, Inc.", "versions": [{"status": "affected", "version": "before 5.16.0"}]}], "datePublic": "2023-12-12T16:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper access control in Zoom Mobile App for iOS and Zoom SDKs for iOS before version 5.16.5 may allow an authenticated user to conduct a disclosure of information via network access."}], "value": "Improper access control in Zoom Mobile App for iOS and Zoom SDKs for iOS before version 5.16.5 may allow an authenticated user to conduct a disclosure of information via network access."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-449", "description": "CWE-449: The UI Performs the Wrong Action", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "shortName": "Zoom", "dateUpdated": "2024-09-27T19:16:27.688Z"}, "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-23058/"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T19:44:43.663Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-23058/", "tags": ["x_transferred"]}]}]}}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zoom:meeting_software_development_kit:*:*:*:*:*:android:*:*", "matchCriteriaId": "E725B855-C1FD-40B0-B5DD-164CB83D0F53", "versionEndExcluding": "5.16.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:meeting_software_development_kit:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "921ABABB-33A6-4B83-844B-236C549B48CF", "versionEndExcluding": "5.16.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:video_software_development_kit:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "0141CCFA-C930-4649-8894-4B093AE63848", "versionEndExcluding": "5.16.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:zoom:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "C2BF4129-CA54-4ECB-9A6B-EC28445233DF", "versionEndExcluding": "5.16.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Improper access control in Zoom Mobile App for iOS and Zoom SDKs for iOS before version 5.16.5 may allow an authenticated user to conduct a disclosure of information via network access."}, {"lang": "es", "value": "Un control de acceso inadecuado en la aplicaci\u00f3n Zoom Mobile para iOS y los SDK de Zoom para iOS anteriores a la versi\u00f3n 5.16.5 puede permitir que un usuario autenticado realice una divulgaci\u00f3n de informaci\u00f3n a trav\u00e9s del acceso a la red."}], "id": "CVE-2023-43585", "lastModified": "2024-11-21T08:24:26.730", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.2, "source": "security@zoom.us", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2023-12-13T23:15:07.463", "references": [{"source": "security@zoom.us", "tags": ["Vendor Advisory"], "url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-23058/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-23058/"}], "sourceIdentifier": "security@zoom.us", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-449"}], "source": "security@zoom.us", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}]}