CVE-2021-28133 Information disclosure in n/a
Attackers can view private screen contents not explicitly shared during Zoom meetings, exposing sensitive data to other participants.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-28133?
CVE-2021-28133 is a medium-severity vulnerability in Zoom Zoom, published on 18 Mar 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Zoom through 5.5.4 sometimes allows attackers to read private information on a participant's screen, even though the participant never attempted to share the private part of their screen. When a user shares a specific application window via the Share Screen functionality, other meeting participants can briefly see contents of other application windows that were explicitly not shared. The contents of these other windows can (for instance) be seen for a short period of time when they overlay the shared window and get into focus. (An attacker can, of course, use a separate screen-recorder application, unsupported by Zoom, to save all such contents for later replays and analysis.) Depending on the unintentionally shared data, this short exposure of screen contents may be a more or less severe security issue.
Weakness: CWE-200
Which versions are affected by CVE-2021-28133?
It affects 1 product.
Products include Zoom Zoom.
How do I fix CVE-2021-28133?
No fix has been published for CVE-2021-28133 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-28133 being exploited?
There is no known exploitation of CVE-2021-28133 in the wild and no public exploit code.
Other vulnerabilities in Zoom Zoom
Sources
Also known as GHSA-qj56-qx26-7qr8.