CVE-2023-3947

Video Conferencing with Zoom <= 4.2.1 - Sensitive Information Exposure

2023-07-25 00:00

Strategic Overview

Status: Patched in 4.2.2
Affected Plugin: Video Conferencing with Zoom
Affected Version: <= 4.2.1
CVSS: 3.7Low
Weakness type: CWE-321 · Use of Hard-coded Cryptographic Key
CVE: CVE-2023-3947

View all Video Conferencing with Zoom vulnerabilities

At a glance

CVE-2023-3947 is a low-severity Use of Hard-coded Cryptographic Key vulnerability in the Video Conferencing with Zoom WordPress plugin, affecting versions <= 4.2.1. It carries a CVSS score of 3.7 (reachable over the network). Exploitation requires no authentication. The issue is fixed in version 4.2.2; sites on affected versions should update now. Disclosed July 2023, reported by István Márton.

Vulnerability Overview

The Video Conferencing with Zoom plugin for WordPress is vulnerable to Sensitive Information Exposure due to hardcoded encryption key on the 'vczapi_encrypt_decrypt' function in versions up to, and including, 4.2.1. This makes it possible for unauthenticated attackers to decrypt and view the meeting id and password.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, and no privileges on the target site, and no interaction from a victim user.

CWE-321: Use of Hard-coded Cryptographic Key

The product uses a hard-coded, unchangeable cryptographic key.

Remediation

Update to version 4.2.2, or a newer patched version

How does WordSec protect against this?

The fix is the thing that ends this: Video Conferencing with Zoom 4.2.2 closes this, and updating the plugin is the step that ends it.

Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2023-3947 https://www.wordfence.com/threat-intel/vulnerabilities/id/ba2515d9-ced0-4b49-87c4-04c8391c2608 https://nvd.nist.gov/vuln/detail/CVE-2023-3947

Related records

CVSS Vector

3.7

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Base

Attack VectorNetwork
Attack ComplexityHigh
Privileges RequiredNone
User InteractionNone
ScopeUnchanged
ConfidentialityLow
IntegrityNone
AvailabilityNone

This record contains material that is subject to copyright

CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

https://www.cve.org/Legal/TermsOfUse

Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.

https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/