PT-2023-2194 · Zoom · Zoom Client For It Admin

CVE-2023-22883 · Publicado 2023-03-15 · Atualizado 2023-03-23

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoom Client for IT Admin versions prior to 5.13.5

Description The issue is related to a local privilege escalation vulnerability in the Zoom Client for IT Admin Windows installers. It is caused by synchronization errors when using a shared resource. A local low-privileged user could exploit this vulnerability during the installation process to escalate their privileges to the SYSTEM user.

Recommendations For versions prior to 5.13.5, update to version 5.13.5 or later to resolve the issue. As a temporary workaround, consider restricting the installation process to trusted users until the update is applied.

Correção

Time Of Check To Time Of Use

Enumeração de Fraquezas

CWE-367

Identificadores relacionados

BDU:2023-01939

CVE-2023-22883

Produtos afetados

Zoom Client For It Admin

Referências · 6

• https://osv.dev/vulnerability/CVE-2023-22883 · Aviso do Fabricante
• https://t.me/pentestingnews/34069 · Publicação no Telegram
• https://explore.zoom.us/en/trust/security/security-bulletin · Aviso do Fabricante
• https://t.me/cibsecurity/60210 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-22883 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-01939 · Nota de Segurança