PT-2023-2194 · Zoom · Zoom Client For It Admin

Published 2023-03-15 · Updated 2023-03-23 · CVE-2023-22883

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoom Client for IT Admin versions prior to 5.13.5

Description The issue is related to a local privilege escalation vulnerability in the Zoom Client for IT Admin Windows installers. It is caused by synchronization errors when using a shared resource. A local low-privileged user could exploit this vulnerability during the installation process to escalate their privileges to the SYSTEM user.

Recommendations For versions prior to 5.13.5, update to version 5.13.5 or later to resolve the issue. As a temporary workaround, consider restricting the installation process to trusted users until the update is applied.

Fix

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

BDU:2023-01939

CVE-2023-22883

Affected Products

Zoom Client For It Admin

References · 6

• https://osv.dev/vulnerability/CVE-2023-22883 · Vendor Advisory
• https://explore.zoom.us/en/trust/security/security-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-22883 · Security Note
• https://bdu.fstec.ru/vul/2023-01939 · Security Note
• https://t.me/pentestingnews/34069 · Telegram Post
• https://t.me/cibsecurity/60210 · Telegram Post