PT-2022-19218 · Zoom · Zoom Client For Meetings+1

Published 2022-11-14 · Updated 2022-11-18 · CVE-2022-28764

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Zoom Client for Meetings versions prior to 5.12.6

Description The issue arises from a failure to clear data from a local SQL database after a meeting ends, combined with the use of an insufficiently secure per-device key to encrypt that database. This allows a local malicious user to obtain meeting information, such as in-meeting chat for the previous meeting attended from that local user account.

Recommendations For versions prior to 5.12.6, update to version 5.12.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the local SQL database until a patch is applied.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-459

Related Identifiers

CVE-2022-28764

Affected Products

Zoom Client For Meetings

Zoom

References · 5

• https://osv.dev/vulnerability/CVE-2022-28764 · Vendor Advisory
• https://explore.zoom.us/en/trust/security/security-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28764 · Security Note
• https://t.me/cvenotify/38008 · Telegram Post
• https://t.me/cvenotify/37677 · Telegram Post