Cloud Vulnerability DB
A community-led vulnerabilities database
Vulnerability DatabaseCVE-2022-28764
CVE-2022-28764:
Zoom Client vulnerability analysis and mitigation
Overview
CVE-2022-28764 is a local information exposure vulnerability affecting the Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) versions prior to 5.12.6. The vulnerability was disclosed and addressed by November 14, 2022 (NVD).
Technical details
The vulnerability stems from two key issues: a failure to clear data from a local SQL database after a meeting ends, and the usage of an insufficiently secure per-device key encrypting that database. The vulnerability has been assigned a CVSS v3.1 Base Score of 3.3 (LOW) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, indicating local access is required (NVD).
Impact
If exploited, the vulnerability allows a local malicious user to obtain meeting information, specifically in-meeting chat data, from the previous meeting attended from that local user account (NVD).
Mitigation and workarounds
The vulnerability was fixed in Zoom Client for Meetings version 5.12.6. Users are recommended to update to this version or later to address the security issue (ManageEngine).
Additional resources
Source: This report was generated using AI
Related Zoom Client vulnerabilities:
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Additional Wiz resources
Get a personalized demo
Ready to see Wiz in action?
"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management