Skip to main content

Meeting Software Development Kit CVE-2023-43583

MEDIUM
Use of Hard-coded Credentials (CWE-798)
2023-12-13 security@zoom.us
Apple Google Authentication Bypass Meeting Software Development Kit Video Software Development Kit Zoom
4.9
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
4.9 MEDIUM
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Dec 13, 2023 - 23:15 nvd
MEDIUM 4.9

DescriptionNVD

Cryptographic issues Zoom Mobile App for Android, Zoom Mobile App for iOS, and Zoom SDKs for Android and iOS before version 5.16.0 may allow a privileged user to conduct a disclosure of information via network access.

AnalysisAI

Cryptographic issues Zoom Mobile App for Android, Zoom Mobile App for iOS, and Zoom SDKs for Android and iOS before version 5.16.0 may allow a privileged user to conduct a disclosure of information. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Use of Hard-coded Credentials (CWE-798), which allows attackers to gain access using credentials embedded in source code. Cryptographic issues Zoom Mobile App for Android, Zoom Mobile App for iOS, and Zoom SDKs for Android and iOS before version 5.16.0 may allow a privileged user to conduct a disclosure of information via network access. Affected products include: Zoom Meeting Software Development Kit, Zoom Video Software Development Kit, Zoom. Version information: version 5.16.0.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Remove hard-coded credentials, use environment variables or secrets management, rotate exposed credentials immediately.

More in Meeting Software Development Kit

View all
CVE-2024-24691 CRITICAL
9.8 Feb 14

Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Wind
CVE-2025-49457 CRITICAL
9.6 Aug 12

Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of

CVE-2023-49647 HIGH
8.8 Jan 12

Improper access control in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows befor
CVE-2023-43586 HIGH
8.8 Dec 13

Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an a
CVE-2024-45421 HIGH
8.5 Feb 25

Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network acce
CVE-2023-39214 HIGH
8.1 Aug 08

Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial

CVE-2024-24697 HIGH
7.8 Feb 14

Untrusted search path in some Zoom 32 bit Windows clients may allow an authenticated user to conduct an escalation of pr
CVE-2024-45422 HIGH
7.5 Nov 19

Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial o
CVE-2024-45419 HIGH
7.5 Nov 19

Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via
CVE-2024-27241 HIGH
7.5 Jul 15

Improper input validation in some Zoom Apps and SDKs may allow an authenticated user to conduct a denial of service via

CVE-2023-39217 HIGH
7.5 Aug 08

Improper input validation in Zoom SDK’s before 5.14.10 may allow an unauthenticated user to enable a denial of service v
CVE-2023-36533 HIGH
7.5 Aug 08

Uncontrolled resource consumption in Zoom SDKs before 5.14.7 may allow an unauthenticated user to enable a denial of ser

Same weakness CWE-798 – Use of Hard-coded Credentials

View all
CVE-2016-1560 CRITICAL POC
9.8
CVE-2017-14143 CRITICAL POC
9.8
CVE-2026-22769 CRITICAL
10.0
CVE-2016-5678 CRITICAL POC
9.8
CVE-2017-6558 CRITICAL POC
9.8
CVE-2015-7246 CRITICAL POC
9.8
CVE-2015-4667 CRITICAL POC
9.8
CVE-2016-10177 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2023-43583 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy