Lucene search

ZoomCVE-2023-43586

HistoryDec 13, 2023 - 11:15 p.m.

CVE-2023-43586

2023-12-1323:15:07

CWE-426

CWE-22

Zoom

web.nvd.nist.gov

cve-2023-43586

zoom

desktop client

windows

path traversal

escalation of privilege

network access

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

19.0%

JSON

Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to conduct an escalation of privilege via network access.

Affected configurations

Nvd

Node

zoommeeting_software_development_kitRange<5.16.5windows

zoomvideo_software_development_kitRange<5.16.5windows

zoomvirtual_desktop_infrastructureRange<5.14.14

zoomvirtual_desktop_infrastructureRange5.15.0–5.15.12

zoomzoomRange<5.16.5windows

VendorProductVersionCPE
zoommeeting_software_development_kit*cpe:2.3:a:zoom:meeting_software_development_kit:*:*:*:*:*:windows:*:*
zoomvideo_software_development_kit*cpe:2.3:a:zoom:video_software_development_kit:*:*:*:*:*:windows:*:*
zoomvirtual_desktop_infrastructure*cpe:2.3:a:zoom:virtual_desktop_infrastructure:*:*:*:*:*:*:*:*
zoomzoom*cpe:2.3:a:zoom:zoom:*:*:*:*:*:windows:*:*

Vendor	Product	Version	CPE
zoom	meeting_software_development_kit	*	cpe:2.3:a:zoom:meeting_software_development_kit::::::windows::*
zoom	video_software_development_kit	*	cpe:2.3:a:zoom:video_software_development_kit::::::windows::*
zoom	virtual_desktop_infrastructure	*	cpe:2.3:a:zoom:virtual_desktop_infrastructure::::::::
zoom	zoom	*	cpe:2.3:a:zoom:zoom::::::windows::*

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows"
    ],
    "product": "Zoom Desktop Client for Windows, Zoom VDI Client for Windows and Zoom SDKs for Windows",
    "vendor": "Zoom Video Communications, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "See references"
      }
    ]
  }
]

References

www.zoom.com/en/trust/security-bulletin/ZSB-23059/

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

19.0%

JSON

Related for CVE-2023-43586