CVE-2023-28602: 
NixOS vulnerability analysis and mitigation

Zoom for Windows clients prior to version 5.13.5 contain an improper verification of cryptographic signature vulnerability identified as CVE-2023-28602. The vulnerability was disclosed and fixed in June 2023, affecting Zoom's Windows client software (NVD, CVE).

The vulnerability is classified as CWE-347 (Improper Verification of Cryptographic Signature). According to the National Vulnerability Database, it received a CVSS v3.1 base score of 7.7 (HIGH) from NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N, while Zoom assessed it with a lower score of 2.8 (LOW) with vector string CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N (NVD).

The vulnerability could allow a malicious user to potentially downgrade Zoom Client components to previous versions, potentially exposing users to security issues present in older versions (NVD).

The vulnerability requires local access and elevated privileges for exploitation, as indicated by the CVSS vector string. However, specific details about exploits in the wild are not available in the provided sources.

The vulnerability has been fixed in Zoom version 5.13.5. Users are recommended to update their Zoom Windows clients to version 5.13.5 or later to address this security issue (ManageEngine).