Vulnerabilities > CVE-2022-28764 - Incomplete Cleanup vulnerability in Zoom Meetings, Rooms and VDI Windows Meeting Clients

CVSS 3.3 - LOW

Attack vector

LOCAL

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

LOW

Integrity impact

NONE

Availability impact

NONE

local

low complexity

zoom

CWE-459

NVD

Published: 2022-11-14

Updated: 2022-11-17

Summary

The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.6 is susceptible to a local information exposure vulnerability. A failure to clear data from a local SQL database after a meeting ends and the usage of an insufficiently secure per-device key encrypting that database results in a local malicious user being able to obtain meeting information such as in-meeting chat for the previous meeting attended from that local user account.

Vulnerable Configurations

Part	Description	Count
Application	Zoom Zoom VDI Windows Meeting Clients - Zoom Rooms - Zoom Rooms 4.6.5 Zoom Rooms 5.0.0 Zoom Rooms 5.0.2 Zoom Rooms 5.0.3 Zoom Rooms 5.0.4 Zoom Rooms 5.0.5 Zoom Rooms 5.1.0 Zoom Rooms 5.1.1 Zoom Rooms 5.1.2 Zoom Rooms 5.2.0 Zoom Rooms 5.2.1 Zoom Rooms 5.2.2 Zoom Rooms 5.3.0 Zoom Rooms 5.4.0 Zoom Rooms 5.4.3 Zoom Rooms 5.5.0 Zoom Rooms 5.5.1 Zoom Rooms 5.6.0 Zoom Rooms 5.6.3 Zoom Rooms 5.6.7 Zoom Rooms 5.7.0 Zoom Rooms 5.7.3 Zoom Rooms 5.7.5 Zoom Rooms 5.8.0 Zoom Rooms 5.11.0 Zoom Meetings - Zoom Meetings 5.8.6 Zoom Meetings 5.9.0 Zoom Meetings 4.6.9 Zoom Meetings 4.6.10 Zoom Meetings 4.6.11 Zoom Meetings 4.6.12 Zoom Meetings 5.0.0 Zoom Meetings 5.0.1 Zoom Meetings 5.0.2 Zoom Meetings 5.0.3 Zoom Meetings 5.0.4 Zoom Meetings 5.0.5 Zoom Meetings 5.1.0 Zoom Meetings 5.1.1 Zoom Meetings 5.1.2 Zoom Meetings 5.2.0 Zoom Meetings 5.2.1 Zoom Meetings 5.2.2 Zoom Meetings 5.2.3 Zoom Meetings 5.3.0 Zoom Meetings 5.3.1 Zoom Meetings 5.3.2 Zoom Meetings 5.4.0 Zoom Meetings 5.4.1 Zoom Meetings 5.4.2 Zoom Meetings 5.4.3 Zoom Meetings 5.4.4 Zoom Meetings 5.4.6 Zoom Meetings 5.4.7 Zoom Meetings 5.4.9 Zoom Meetings 5.5.0 Zoom Meetings 5.5.1 Zoom Meetings 5.5.2 Zoom Meetings 5.5.4 Zoom Meetings 5.5.5 Zoom Meetings 5.6.0 Zoom Meetings 5.6.1 Zoom Meetings 5.6.3 Zoom Meetings 5.6.4 Zoom Meetings 5.6.6 Zoom Meetings 5.6.7 Zoom Meetings 5.7.1 Zoom Meetings 5.7.3 Zoom Meetings 5.7.4 Zoom Meetings 5.7.5 Zoom Meetings 5.7.6 Zoom Meetings 5.8.0 Zoom Meetings 5.9.6 Zoom Meetings 5.10.6 Zoom Meetings 5.11.3 Zoom Meetings 5.11.5 Zoom Meetings 5.12.0 Zoom Meetings 5.1.3 Zoom Meetings 5.7.0 Zoom Meetings 5.7.7 Zoom Meetings 5.7.8	128

Common Weakness Enumeration (CWE)

CWE-459 - Incomplete Cleanup

References

https://explore.zoom.us/en/trust/security/security-bulletin/