PT-2023-26960 · WordPress · Video Conferencing With Zoom

István Márton + 1 · Published 2023-07-26 · Updated 2023-08-02 · CVE-2023-3947

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Video Conferencing with Zoom plugin for WordPress versions up to, and including, 4.2.1

Description The issue is related to Sensitive Information Exposure due to a hardcoded encryption key in the vczapi encrypt decrypt function. This allows unauthenticated attackers to decrypt and view the meeting id and password.

Recommendations For versions up to, and including, 4.2.1, update to a version that fixes the hardcoded encryption key issue in the vczapi encrypt decrypt function. As a temporary workaround, consider disabling the vczapi encrypt decrypt function until a patch is available.

Fix

Weakness Enumeration

CWE-321

Related Identifiers

CVE-2023-3947

Affected Products

Video Conferencing With Zoom

References · 7

• https://osv.dev/vulnerability/CVE-2023-3947 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3947 · Security Note
• https://plugins.trac.wordpress.org/browser/video-conferencing-with-zoom-api/trunk/includes/Helpers/Encryption.php?rev=2942302 · Patch
• https://plugins.trac.wordpress.org/browser/video-conferencing-with-zoom-api/tags/4.2.1/includes/helpers.php#L546 · Patch
• https://t.me/cibsecurity/67284 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ba2515d9-ced0-4b49-87c4-04c8391c2608?source=cve · Note
• https://t.me/cvenotify/55159 · Telegram Post