# MA-1004.122023: MyCERT Advisory - Multiple Vulnerabilities in Zoom Products

**Date:** 21 Dec 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1004.122023  
**Advisory ID:** MA-1004.122023

---

**1.0 Introduction**
The popular video messaging platform, Zoom, has discovered multiple vulnerabilities affecting Zoom products. These vulnerabilities might allow an unauthorized user to gain unauthorized access to sensitive data, disrupt meetings and potentially compromise systems.
**2.0Vulnerability Details and Severity Level**
|  |  | --- | --- | --- | --- | ZSB | Title | Severity | CVE | ZSB-23059 | Zoom Desktop Client for Windows, Zoom VDI Client for Windows and Zoom SDKs for Windows – Path Traversal | High | CVE-2023-43586 | ZSB-23058 | Zoom Mobile App for iOS and SDKs for iOS – Improper Access Control | High | CVE-2023-43585 | ZSB-23062 | Zoom Clients – Improper Authentication | Medium | CVE-2023-49646 | ZSB-23056 | Zoom Mobile App for Android, Zoom Mobile App for iOS and Zoom SDKs – Cryptographic Issues | Medium | Cve-2023-43583 |
**3.0 Impact**
The vulnerability may allow an attacker to conduct a denial of service, escalation of privilege and disclosure of information via network access.
**4.0Affected Products**
1. Zoom Desktop Client for Windows before version 5.16.5
2. Zoom Desktop Client for macOS before version 5.16.5
3. Zoom Mobile APP for iOS before version 5.16.5
4. Zoom Mobile APP for Android before version 5.16.5
5. Zoom Desktop Client for Linux before Version 5.16.5
6. Zoom VDI Client before version 5.16.5 (excluding 5.14.14 and 5.15.12)
7. Zoom SDKs before version 5.16.5
**5.0 Recommendations**
Users and system administrators are encouraged to review the Zoom Security Bulletin and upgrade to the latest version.
Kindly refer to the URL for more information:
<https://www.zoom.com/en/trust/security-bulletin/>
Generally, we advise the users of these devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact us through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**6.0    References**
- <https://www.zoom.com/en/trust/security-bulletin/>
- <https://www.cvedetails.com/vulnerability-list/vendor_id-2159/Zoom.html>