CVE-2023-28598 Cross-site scripting in Zoom for Linux clients

High 7.5 Published 13 Jun 2023 Updated 2 Jan 2025

A malicious user can cause a Zoom Linux client crash via HTML injection in chat, requiring an upgrade to fix.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-28598?

CVE-2023-28598 is a high-severity cross-site scripting vulnerability in Zoom Zoom, published on 13 Jun 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Zoom for Linux clients prior to 5.13.10 contain an HTML injection vulnerability. If a victim starts a chat with a malicious user it could result in a Zoom application crash.

Weakness: CWE-74, CWE-79

Which versions are affected by CVE-2023-28598?

It affects 1 product.

Products include Zoom Zoom.

How do I fix CVE-2023-28598?

No fix has been published for CVE-2023-28598 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2023-28598 being exploited?

There is no known exploitation of CVE-2023-28598 in the wild and no public exploit code.

All Zoom Zoom vulnerabilities

Sources

Also known as GHSA-r4jh-xqh3-r437.