CVE-2023-28603 Path traversal in Zoom VDI Windows Meeting Client
A malicious user can delete local files without proper permissions in the Zoom VDI client installer due to improper access control.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-28603?
CVE-2023-28603 is a high-severity path traversal vulnerability in Zoom VDI Windows Meeting Client, published on 13 Jun 2023. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Zoom VDI client installer prior to 5.14.0 contains an improper access control vulnerability. A malicious user may potentially delete local files without proper permissions.
Weakness: CWE-73
Which versions are affected by CVE-2023-28603?
It affects 1 product.
Products include Zoom Virtual Desktop Infrastructure.
How do I fix CVE-2023-28603?
No fix has been published for CVE-2023-28603 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-28603 being exploited?
There is no known exploitation of CVE-2023-28603 in the wild and no public exploit code.
Other vulnerabilities in Zoom VDI Windows Meeting Client
Sources
Also known as GHSA-4g7c-75vj-hqfj.