Improperly constrained session cookies in Zoom Client for Meetings
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.9epss 3.5%
probabilidade de exploração
3.5%top 12% das CVEs
exploração observada
nãonenhuma fonte reporta
The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom domains. This issue could be used in a more sophisticated attack to send an unsuspecting users Zoom-scoped session cookies to a non-Zoom domain. This could potentially allow for spoofing of a Zoom user.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L
Produtos afetados
Zoom Video Communications Inc · Zoom Client for Meetings for AndroidZoom Video Communications Inc · Zoom Client for Meetings for iOSZoom Video Communications Inc · Zoom Client for Meetings for LinuxZoom Video Communications Inc · Zoom Client for Meetings for MacOSZoom Video Communications Inc · Zoom Client for Meetings for Windows