**Platform Impacted**

This metric allows the user to specify the type of computing platform impacted by the security vulnerability, not necessarily where the security vulnerability was found. Zoom considers the Desktop and Mobile apps an extension of the Zoom infrastructure.

The possible values for this metric are:

- ***N/A***: Default value. Users must select a value from the Platform list in order to selectively enable associated metrics.
- ***3rd Party Hosted/Tool/Library***: Impact has been demonstrated to affect a Party Hosted/Tool/Library hosted by a
third party 
- ***Mobile Application***: The demonstrated impact is limited to a mobile device
- ***Desktop Application***: The demonstrated impact is limited to a desktop device
- ***Browser App / API Endpoint***: The demonstrated impact is limited to a browser-based application and/or an API
endpoint(s)
- ***Customer Infrastructure***: The demonstrated impact is limited to an on-prem customer infrastructure
- ***Zoom Infrastructure***: The demonstrated impact is limited to Zoom's Cloud-based or on-prem infrastructure
- ***Documentation***: The product documentation does not match the functionality of the product.

Platform Impacted

3rd Party Hosted/Tool/Library

Mobile Application

Browser App / API Endpoint

Desktop Application

Customer Infrastructure

Zoom Infrastructure

Documentation

**Platform Impact**

This section of metrics allows the user to specify the demonstrated impact on the Confidentiality, Integrity, and
Availability of the platform by the successful exploitation of the security vulnerability found. 

The possible values for the **Confidentiality** and **Integrity** metrics are:

- ***None***: There is no platform impact 
- ***Network/DNS Configuration***: The Primary demonstrated impact is on the machine(s) Network/DNS Configuration
- ***Hardware Configuration***: The Primary demonstrated impact is on the Configuration of the machine's hardware
- ***Container Configuration***: The Primary demonstrated impact is on the Configuration of the Container(s)
- ***OS Configuration***: The Primary demonstrated impact is on the Configuration of the machine operating system(s)
- ***Software Configuration***: The Primary demonstrated impact is on the Configuration of some software running on a machine(s)
- ***PKI/Secrets Configuration***: The Primary demonstrated impact is on the Configuration of some PKI/Secrets on a
machine(s)
- ***User Account Configuration***: The Primary demonstrated impact is on the Configuration of a network/OS user
account
- ***Restricted RCE***: The Primary demonstrated impact is Remote Code Execution that is restricted in some way
- ***Restricted PE***: The Primary demonstrated impact is Privilege Escalation that is restricted in some way
- ***Unrestricted RCE***: The Primary demonstrated impact is Remote Code Execution that is unrestricted
- ***Unrestricted PE***: The Primary demonstrated impact is Privilege Escalation that is unrestricted. This option should
only be used for bugs that allow viss without allowing RCE.


The possible values for the Availability metric should be self-explanitory.

Confidentiality

None

Network/DNS Configuration

Hardware Configuration

Container Configuration

OS Configuration

Software Configuration

PKI/Secrets Configuration

User Account Configuration

Restricted PE

Restricted RCE

Unrestricted PE

Unrestricted RCE

Integrity

Availability

Single Service on Single Container/VM/Machine

Single Service on Multiple Containers/VMs/Machines

Single Service on all Containers/VMs/Machines within a portion of a Geographic Area

Single Service on all Containers/VMs/Machines within an entire Geographic Area

Single Service on all Containers/VMs/Machines within the entire Infrastructure

Multiple Services on Single Container/VM/Machine

Multiple Services on Multiple Containers/VMs/Machines

Multiple Services on all Containers/VMs/Machines within a portion of a Geographic Area

Multiple Services on all Containers/VMs/Machines within an entire Geographic Area

Multiple Services on all Containers/VMs/Machines within the entire Infrastructure

All Services on Single Container/VM/Machine

All Services on Multiple Containers/VMs/Machines

All Services on all Containers/VMs/Machines within a portion of a Geographic Area

All Services on all Containers/VMs/Machines within an entire Geographic Area

All Services on all Containers/VMs/Machines within the entire Infrastructure

**Tenancy**

The Tenancy metric allows the user to specify the tenancy of the infrastructure on which the security vulnerability was found. In many cases, the impact of an exploited vulnerability is more significant when a multi-tenant architecture is
involved. 

The possible values for this metric are:

- ***N/A***: There is no tenancy involved
- ***Single***: The environment impacted only hosts a single tenant
- ***Multi***: The environment impacted hosts multiple tenants

Infrastructure

Single

Multi

Software

Database

**Tenants Impacted**

The Tenants Impacted metric allows the user to specify a summary range of tenants impacted by the successful
exploitation of the security vulnerability found.

The possible values for this metric are:

- ***None***: Impact has been demonstrated to affect no tenants
- ***Dev Only***: Impact has been demonstrated to affect a dev environment only
- ***One***: Impact has been demonstrated to affect only a single tenant
- ***Many***: Impact has been demonstrated to affect more than one, but less than all tenants
- ***All***: Impact has been demonstrated to affect every tenant

Tenants Impacted

Dev Only

Many

**Data Impact**

This section of metrics allows the user to specify the demonstrated impact on the Confidentiality, Integrity, and
Availability of customer or Zoom data by the successful exploitation of the security vulnerability found.

The possible values for these metrics are:

- ***None***: There is no demonstrated impact on the Confidentiality, Integrity, and/or Availability of customer or Zoom
data
- ***Single User (Data Only)***: There is demonstrated impact on the Confidentiality, Integrity, and/or Availability of a
single user without STO or ATO
- ***Single User (Session Takeover)***: There is demonstrated impact on the Confidentiality, Integrity, and/or
Availability of a single customer or Zoom user's data via Session Takeover (STO)
- ***Single User (Account Takeover)***: There is demonstrated impact on the Confidentiality, Integrity, and/or
Availability of customer or Zoom data via Account Takeover (ATO)
- ***Multiple Users (Data Only)***: There is demonstrated impact on the Confidentiality, Integrity, and/or
Availability of multiple user's data without STO or ATO
- ***Multiple Users (Session Takeover)***: There is demonstrated impact on the Confidentiality, Integrity, and/or
Availability of multiple user's data via Session Takeover (STO)
- ***Multiple Users (Account Takeover)***: There is demonstrated impact on the Confidentiality, Integrity, and/or
Availability of multiple user's data via Account Takeover (ATO)
- ***Single Organization (Data Only)***: There is demonstrated impact on the Confidentiality, Integrity, and/or
Availability of all data within a single org, without STO or ATO
- ***Multiple Organizations (Data Only)***: There is demonstrated impact on the Confidentiality, Integrity, and/or
Availability of all data within multiple orgs, without STO or ATO. 
- ***Cross-Organizations (Data Only)***: This option refers to an exploited vulnerability that begins with an
authenticated user in org A but the impact takes place on the data in org B. This may or may not include cross-org STO or ATO.
- ***All Organizations (Data Only)***: There is demonstrated impact on the Confidentiality, Integrity, and/or Availability of all data within all Zoom orgs

Single User - Data Only

Single User - Session Takeover

Multiple Users - Data Only

Single User - Account Takeover

Single Organization - Data Only

Cross-Organizations - Data Only

Multiple Users - Session Takeover

Multiple Users - Account Takeover

Multiple Organizations - Data Only

All Organizations - Data Only

Cross Organization - Data Only

Affects a Single User in a Single Organization

Affects Multiple Users in a Single Organization

Affects all Users in a Single Organization

Affects Attacker's  own Organization Only

Affects Multiple Organizations

Affects All Organizations

**Data Classification**

The Data Classification Impact metric allows the user to specify the sensitivity level of the data involved in the successful exploitation of the security vulnerability found.

The possible values for this metric are:

- ***None***: The data is in no way sensitive. *Potential adverse business impact: **None***

- ***Test Data Only***: The data is test data only. *Potential adverse business impact: **None***

- ***Zoom Public***: Public data is information that may be or must be open to the public. For example, the type of information Zoom publishes on its website or marketing materials. *Potential adverse business
impact: **Low***

- ***Zoom Internal***: Information that provides a competitive advantage or describes internal strategies. Any data not explicitly classified is considered Internal by default. For example, non-public Zoom chat channels, correspondence, and meeting minutes. *Potential adverse business impact: **Medium***

- ***Zoom Confidential***: Information protected by policy, law, contract, or regulation and subject to specific access,
storage, and distribution requirements. Confidential Data includes, but is not limited to: Employee Data, Operations Data, Source Code, Corporate Financial Data, Privileged Data, and Screening Data. Any information entrusted to Zooms' care that is not otherwise categorized as Restricted data. *Potential adverse business impact: **High***

- ***Zoom Restricted***: Data under this classification should not be accessible internally by Zoom without documented authorization and valid business justification. Restricted Data includes, but is not limited to: Sensitive Meeting Metadata, Secrets Data, and Customer Financial Data. *Potential adverse business impact: **Critical***

- ***Customer Public***: Customer Public data is information that may be or must be open to the public. *Potential adverse business impact: **Low*** 

- ***Customer Org Configuration***: Customer org configuration and settings are data associated with their Zoom Org implementation, excluding PD, PII, and sensitive content. *Potential adverse business impact: **Medium*** 

- ***Customer Confidential / Personal User Data / PII***: Information protected by policy, law, contract, or regulation and subject to specific access, storage, and distribution requirements. Confidential Data includes, but is not limited to:

 - Operations Data. Technical information from Zoom’s software or systems hosting the services and from the systems, applications, and devices that are used to access the services:
 - Privileged Data. For example, Financials or contact information regarding current or former business customers, the Monthly Recurring Revenue (“MRR”), etc.
 - Customer information entrusted to Zoom’s care that is not otherwise categorized as Restricted data
 - Customer Data: Information provided to Zoom so that Zoom can fulfill the terms of customer agreements and provide access to Zoom services:
 - First and last name
 - Physical address
 - Email address or online identifier
 - Social Security #
 - Personal ID #
 - Driver’s License #
 - Telephone number
 - Employer
 - Meeting title
 - Profile picture
 - Protected Health Information (PHI),
 - Any “Persistent identifier" such as a customer number stored in a cookie, a “static IP address”, a “mobile device ID”, a “processor serial number”, or “Any information combined with any of” these elements. *Potential adverse business impact: **High***

- ***Customer Irreplaceable***: Content that is/was only stored within the Zoom environment that, if lost, is not retrievable. *Potential adverse business impact: **High***

- ***Customer Restricted Content/Secrets***: Customer passwords, keys, Customer Content, Sensitive Meeting Metadata, Secrets Data, Customer Financial Data and/or secrets of any other sort.

 - Live-streamed, recorded, or shared video, audio, multi-media content, or messaging
 - Application feature data of any kind, including;
 - Polls and survey results data
 - Chat and SMS/MMS data
 - Transcriptions
 - Cloud-storage data
 - Meeting registration and engagement data
 - Reports
 - Zoom Calendar and/or Zmail data including contact info
 - Any data or content originated by a customer or end-user and stored or transmitted using Zoom services, including:
 - Files
 - Documents
 - Recordings and/or Clips
 - Chat logs
 - Meeting subjects
 - Meeting attendees,
 - Meeting transcripts
 - Any other information that customers or end-users may upload into Zoom services in connection with the use of Zoom services.
 - Sensitive Meeting Metadata
 - Data that identifies whom a customer is meeting, chatting with, or calling.
 - Secrets Data: Data used to authenticate or authorize individuals to use electronic resources:
 - Passwords, keys, other electronic tokens, etc.
 - Customer Financial Data: Any data that can be leveraged to commit financial fraud:
 - Credit card numbers, bank account numbers, etc.

*Potential adverse business impact: **Critical***

Data Classification

Customer - Public

Zoom Public

Test Data Only

Customer - Org Configuration

Zoom Internal

Zoom Confidential

Zoom Restricted

Customer - Confidential/Personal Data/PII

Customer - Irreplaceable

Customer - Restricted Content/Secrets

The Compensating Controls metric allows the user to specify the existence of any compensating security controls within the impacted software or infrastructure that have a positive defensive impact against the successful exploitation of the security vulnerability found. The possible values for this metric are:

- ***Internal Control (Prevents Impact)***: An internal security control prevents the impact of vulnerability exploitation.
- ***Internal Control (Limits Impact)***:  An internal security control limits the impact of vulnerability exploitation.
- ***Exploit Requires Entropic Key***:  Successful vulnerability exploitation requires knowledge of an object key,
encryption key, or otherwise extremely difficult to brute-force or guess key.
- ***Exploit Requires User Interaction***: Successful vulnerability exploitation requires user interaction of some kind,
regardless of how likely.

None

0

None

0

None

0

None

0