#VU51622 Exposure of Resource to Wrong Sphere in Zoom Workplace Desktop App for Windows and Zoom Workplace Desktop App for Linux - CVE-2021-28133

Vulnerability identifier: #VU51622

Vulnerability risk: Low

CVSSv4.0: 0.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2021-28133

CWE-ID: N/A

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Zoom Workplace Desktop App for Windows
Client/Desktop applications / Office applications
Zoom Workplace Desktop App for Linux
Client/Desktop applications / Office applications

Vendor: Zoom Video Communications, Inc.

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists within the screen lock functionality due to the way the Zoom client for Windows and Linux handles screen sharing. When a user shares a specific application window via the Share Screen functionality, other meeting participants can briefly see contents of other application windows that were explicitly not shared.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Zoom Workplace Desktop App for Windows: 5.0.0 23168.0427 - 5.5.4 13142.0301

Zoom Workplace Desktop App for Linux: 5.1.418436.0628 - 5.5.2 7011.0206

---

External links
https://seclists.org/fulldisclosure/2021/Mar/48
https://thehackernews.com/2021/03/new-zoom-screen-sharing-bug-lets-other.html
https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2020-044.txt
https://www.syss.de/pentest-blog/syss-2020-044-sicherheitsproblem-in-screen-sharing-funktionalitaet-von-zoom-cve-2021-28133
https://www.youtube.com/watch?v=SonmmgQlLzg
https://zoom.us/trust/security/security-bulletin

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.