{"id":"CVE-2023-28599","state":"PUBLISHED","title":"Zoom clients prior to 5.13.10 contain an HTML injection vulnerability.  A malicious user could inject HTML into  their display name potentially leading a victim to a malicious webs","description":"Zoom clients prior to 5.13.10 contain an HTML injection vulnerability.  A malicious user could inject HTML into  their display name potentially leading a victim to a malicious website during meeting creation.","publishedAt":"2023-06-13T16:55:46.889Z","updatedAt":"2025-01-02T20:02:33.519Z","severity":{"score":4.3,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","source":"Zoom"},"assigner":"Zoom","products":["Zoom Video Communications, Inc. Zoom for Android","Zoom Video Communications, Inc. Zoom for iOS","Zoom Video Communications, Inc. Zoom for Linux","Zoom Video Communications, Inc. Zoom for macOS","Zoom Video Communications, Inc. Zoom for Windows"],"affected":[{"vendor":"Zoom Video Communications, Inc.","product":"Zoom for Android","defaultStatus":"unaffected","versions":[{"version":"before 5.13.10","status":"affected"}]},{"vendor":"Zoom Video Communications, Inc.","product":"Zoom for iOS","defaultStatus":"unaffected","versions":[{"version":"before 5.13.10","status":"affected"}]},{"vendor":"Zoom Video Communications, Inc.","product":"Zoom for Linux","defaultStatus":"unaffected","versions":[{"version":"before 5.13.10","status":"affected"}]},{"vendor":"Zoom Video Communications, Inc.","product":"Zoom for macOS","defaultStatus":"unaffected","versions":[{"version":"before 5.13.10","status":"affected"}]},{"vendor":"Zoom Video Communications, Inc.","product":"Zoom for Windows","defaultStatus":"unaffected","versions":[{"version":"before 5.13.10","status":"affected"}]}],"references":["https://explore.zoom.us/en/trust/security/security-bulletin/"],"weaknesses":["CWE-79"],"ingestedAt":"2026-10-29T20:05:52.290Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/28xxx/CVE-2023-28599.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-28599","state":"PUBLISHED","datePublished":"2023-06-13T16:55:46.889Z","dateUpdated":"2025-01-02T20:02:33.519Z","assignerShortName":"Zoom","assignerOrgId":"99b9af0d-a833-4a5d-9e2f-8b1324f35351","dateReserved":"2023-03-17T13:27:32.368Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Zoom clients prior to 5.13.10 contain an HTML injection vulnerability.  A malicious user could inject HTML into  their display name potentially leading a victim to a malicious website during meeting creation."}],"affected":[{"vendor":"Zoom Video Communications, Inc.","product":"Zoom for Android","defaultStatus":"unaffected","versions":[{"version":"before 5.13.10","status":"affected"}]},{"vendor":"Zoom Video Communications, Inc.","product":"Zoom for iOS","defaultStatus":"unaffected","versions":[{"version":"before 5.13.10","status":"affected"}]},{"vendor":"Zoom Video Communications, Inc.","product":"Zoom for Linux","defaultStatus":"unaffected","versions":[{"version":"before 5.13.10","status":"affected"}]},{"vendor":"Zoom Video Communications, Inc.","product":"Zoom for macOS","defaultStatus":"unaffected","versions":[{"version":"before 5.13.10","status":"affected"}]},{"vendor":"Zoom Video Communications, Inc.","product":"Zoom for Windows","defaultStatus":"unaffected","versions":[{"version":"before 5.13.10","status":"affected"}]}],"references":[{"url":"https://explore.zoom.us/en/trust/security/security-bulletin/"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Zoom","orgId":"99b9af0d-a833-4a5d-9e2f-8b1324f35351","dateUpdated":"2024-09-19T13:40:50.630Z"},"datePublic":"2023-06-13T16:00:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://explore.zoom.us/en/trust/security/security-bulletin/","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T13:43:23.583Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-01-02T20:02:14.695132Z","id":"CVE-2023-28599","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-01-02T20:02:33.519Z"}}]}}}