CVE-2023-22880 : What You Need to Know

This CVE-2023-22880 pertains to an information disclosure vulnerability found in Zoom for Windows clients before version 5.13.3, Zoom Rooms for Windows clients before version 5.13.5, and Zoom VDI for Windows clients before 5.13.1. The vulnerability involves the utilization of the Microsoft Edge WebView2 runtime by the affected Zoom clients, causing transmitted text to be sent to Microsoft's online Spellcheck service instead of the local Windows Spellcheck.

Understanding CVE-2023-22880

This section delves deeper into the details of CVE-2023-22880, highlighting its impact, technical aspects, and mitigation strategies.

What is CVE-2023-22880?

CVE-2023-22880 involves an information disclosure vulnerability in Zoom for Windows clients, Zoom Rooms for Windows clients, and Zoom VDI for Windows clients before specified versions. The vulnerability allows for the unintended transmission of text to Microsoft's online Spellcheck service instead of the intended local Windows Spellcheck.

The Impact of CVE-2023-22880

The impact of this vulnerability is categorized as high in terms of confidentiality. A threat actor could exploit this vulnerability to potentially access sensitive information, leading to privacy breaches and data leaks.

Technical Details of CVE-2023-22880

This section provides a more technical overview of the vulnerability, including its description, affected systems and versions, as well as the exploitation mechanism.

Vulnerability Description

The vulnerability in Zoom for Windows clients arises from the misuse of the Microsoft Edge WebView2 runtime, causing text to be sent to an unintended Spellcheck service. This results in information disclosure to external sources.

Affected Systems and Versions

Zoom for Windows: Versions less than 5.13.3 are affected.
Zoom Rooms for Windows: Versions less than 5.13.5 are affected.
Zoom VDI for Windows: Versions less than 5.13.1 are affected.

Exploitation Mechanism

Exploiting this vulnerability involves sending text to Microsoft's online Spellcheck service instead of the local Windows Spellcheck, potentially exposing sensitive information to unauthorized entities.

Mitigation and Prevention

To address CVE-2023-22880 and enhance security posture, it is crucial to implement immediate steps, follow long-term security practices, and apply necessary patches and updates.

Immediate Steps to Take

Updating Zoom to at least version 5.13.3, Zoom Rooms to at least version 5.13.5, and Zoom VDI to at least version 5.13.1 is essential to mitigate this vulnerability. Disabling the specific feature that triggers the information disclosure is crucial.

Long-Term Security Practices

Maintaining up-to-date software versions, conducting regular security assessments, and educating users on safe computing practices can help prevent similar vulnerabilities in the future.

Patching and Updates

Updating the Microsoft Edge WebView2 Runtime to at least version 109.0.1481.0 and restarting Zoom can remediate this vulnerability by adjusting Microsoft's telemetry behavior and ensuring the correct handling of text inputs.