Cyber Resilience

CVE-2023-36539

Info Disclosure in Zoom 5.15.0 … 5.15.1

Published
30 June 2023
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0053 42th percentile
Risk Priority 42 floored blend · peak EPSS

Summary

CVE-2023-36539 is a medium-severity Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) vulnerability in Zoom Zoom. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Token Impersonation/Theft (T1134.001); ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1134.001 Token Impersonation/Theft Stealth
Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls.
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
T1552.001 Credentials In Files Credential Access
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.
T1552.002 Credentials in Registry Credential Access
Adversaries may search the Registry on compromised systems for insecurely stored credentials.
T1552.004 Private Keys Credential Access
Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials.
T1600 Weaken Encryption Defense Impairment
Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-22880Same product: Zoom Rooms
CVE-2024-39822Same product: Zoom Rooms
CVE-2024-42435Same product: Zoom Rooms
CVE-2023-39199Same product: Zoom Meetings
CVE-2023-39206Same product: Zoom Meetings
CVE-2023-39204Same product: Zoom Meetings
CVE-2023-43582Same product: Zoom Meetings
CVE-2023-39205Same product: Zoom Meetings
CVE-2024-24690Same product: Zoom Rooms
CVE-2023-39214Same product: Zoom Rooms

Affected Assets

zoom
meetings
5.15.0, 5.15.1
zoom
rooms
5.15.0
zoom
video software development kit
1.8.0
zoom
zoom
5.15.0, 5.15.1
zoom
poly ccx 700 firmware
5.15.0
zoom
poly ccx 600 firmware
5.15.0
zoom
yealink vp59 firmware
5.15.0
zoom
yealink mp54 firmware
5.15.0
zoom
yealink mp56 firmware
5.15.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 35 hardening rules · 11 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V10.4.9
  • V11.7.1
  • V14.1.2
  • V14.2.4

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-200

Automated marking applies security attributes to system outputs, making it harder for attackers to exploit unmarked sensitive information leading to unauthorized exposure.

addresses: CWE-200

Proper attribute retention and permitted-value enforcement limits unauthorized actors from accessing sensitive information lacking correct labels.

addresses: CWE-200

Prevents unauthorized exposure of sensitive information by prohibiting untrusted external systems from processing or storing it.

addresses: CWE-200

By enforcing authorization matching prior to sharing, the control reduces the risk of exposing sensitive information to unauthorized actors.

addresses: CWE-200

Review and removal of nonpublic information from publicly accessible systems directly prevents exposure of sensitive data to unauthorized actors.

addresses: CWE-200

Data mining protection mechanisms detect and block unauthorized bulk extraction of sensitive data, directly mitigating exposure to unauthorized actors.

addresses: CWE-200

Literacy training teaches users to recognize and avoid actions that result in unauthorized exposure of sensitive information.

addresses: CWE-200

Retaining and monitoring training records confirms personnel have completed privacy and security awareness training on handling sensitive data, reducing the chance of unauthorized exposure due to lack of knowledge.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

PR.AA-05 directly enforces least-privilege authorization that blocks most unauthorized disclosures, yet CWE-200 also arises from logging, error messages, and side-channel paths that access controls alone do not address.

PR.DS-01 mostly match
prevents

Strong encryption is required to protect confidentiality of data-at-rest.

PR.DS-02 mostly match
prevents

Strong encryption is required to protect confidentiality of data-in-transit.

PR.DS-10 mostly match
prevents

PR.DS-10 mostly prevents CWE-200 by directly eliminating unauthorized access to sensitive data-in-use, yet only partially addresses the weakness because CWE-200 spans many other exposure vectors outside runtime protection.

PR.IR-01 mostly match
prevents

PR.IR-01's segmentation/zero-trust controls largely eliminate network-level unauthorized access paths that enable exposure, yet CWE-200 spans many additional vectors (API responses, logs, app logic) that network controls alone cannot close.

PR.PS-06 mostly match
prevents

Secure SDLC practices catch most exposure flaws via design, testing and release controls, yet CWE-200 spans runtime/config issues a single development outcome cannot fully close.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Restricting anonymous or unknown access and encrypting high-value information limits the exposure of sensitive data that would otherwise be obtainable by unauthorized actors.

prevents

Suppressing system details, error specifics, and previous log-on information until successful authentication reduces the information an unauthenticated attacker can gather.

prevents

By requiring owners to assign sensitivity labels and corresponding handling rules, the control ensures that information is not left unmarked and therefore reduces the chance that sensitive data will be exposed to unauthorized actors.

prevents

Requiring encryption, access controls, and recipient authentication for transfers directly reduces the chance that sensitive data reaches an unauthorized observer.

prevents

Secure delivery, protected storage, and confidentiality of allocation records limit exposure of authentication material to unauthorized observers.

prevents

Requiring defined procedures, assigned roles, and technical/organizational measures for handling PII reduces the chance that sensitive personal data will be exposed to unauthorized actors through inadequate handling or missing safeguards.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).

Oracle Linux 8 (2 rules)
  • V-248524 OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. prevents CWE-325
  • V-248535 The OL 8 shadow password suite must be configured to use a sufficient number of hashing rounds. prevents CWE-325
Oracle Linux 9 (2 rules)
  • V-271454 OL 9 must enable FIPS mode. prevents CWE-325
  • V-271756 OL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-326
RHEL 7 (1 rule)
  • V-204497 The Red Hat Enterprise Linux operating system must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. prevents CWE-325
RHEL 8 (2 rules)
  • V-230223 RHEL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. prevents CWE-325
  • V-230224 All RHEL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-326
RHEL 9 (1 rule)
  • V-257879 RHEL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-326
Ubuntu 22.04 (2 rules)
  • V-260650 Ubuntu 22.04 LTS must implement NIST FIPS-validated cryptography to protect classified information and for the following: To provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. prevents CWE-325
  • V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. prevents CWE-200
Ubuntu 24.04 (3 rules)
  • V-270647 Ubuntu 24.04 LTS must not have the telnet package installed. prevents CWE-200
  • V-270744 Ubuntu 24.04 LTS must implement NIST FIPS-validated cryptography to protect classified information and for the following: To provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. prevents CWE-325
  • V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. prevents CWE-200
Windows 10 (1 rule)
  • V-220737 Administrative accounts must not be used with applications that access the Internet, such as web browsers, or with potential Internet sources, such as email. prevents CWE-200
Windows Server 2016 (2 rules)
  • V-224974 Domain-created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-200
  • V-224843 Systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. prevents CWE-326
Windows Server 2019 (1 rule)
  • V-205743 Windows Server 2019 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-200
Windows Server 2022 (1 rule)
  • V-254395 Windows Server 2022 organization created Active Directory Organizational Unit (OU) objects must have proper access control permissions. prevents CWE-200

References