Lucene search

ZoomCVELIST:CVE-2023-28596

HistoryMar 27, 2023 - 12:00 a.m.

CVE-2023-28596 Local Privilege Escalation in Zoom for macOS Installers

2023-03-2700:00:00

CWE-427

Zoom

www.cve.org

cve-2023-28596

privilege escalation

zoom

macos

installers

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

Zoom Client for IT Admin macOS installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges to privileges to root.

CNA Affected

[
  {
    "vendor": "Zoom Video Communications Inc",
    "product": "Zoom Client for Meetings for IT Admin macOS installers",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "5.13.5",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

explore.zoom.us/en/trust/security/security-bulletin/

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

Percentile

5.1%

JSON

Related for CVELIST:CVE-2023-28596