CVE-2023-43586

2023-12-1323:15:07

CWE-22

CWE-426

[email protected]

web.nvd.nist.gov

zoom

windows

path traversal

privilege escalation

network access

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

19.0%

JSON

Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to conduct an escalation of privilege via network access.

Affected configurations

Nvd

Node

zoommeeting_software_development_kitRange<5.16.5windows

zoomvideo_software_development_kitRange<5.16.5windows

zoomvirtual_desktop_infrastructureRange<5.14.14

zoomvirtual_desktop_infrastructureRange5.15.0–5.15.12

zoomzoomRange<5.16.5windows

VendorProductVersionCPE
zoommeeting_software_development_kit*cpe:2.3:a:zoom:meeting_software_development_kit:*:*:*:*:*:windows:*:*
zoomvideo_software_development_kit*cpe:2.3:a:zoom:video_software_development_kit:*:*:*:*:*:windows:*:*
zoomvirtual_desktop_infrastructure*cpe:2.3:a:zoom:virtual_desktop_infrastructure:*:*:*:*:*:*:*:*
zoomzoom*cpe:2.3:a:zoom:zoom:*:*:*:*:*:windows:*:*

Vendor	Product	Version	CPE
zoom	meeting_software_development_kit	*	cpe:2.3:a:zoom:meeting_software_development_kit::::::windows::*
zoom	video_software_development_kit	*	cpe:2.3:a:zoom:video_software_development_kit::::::windows::*
zoom	virtual_desktop_infrastructure	*	cpe:2.3:a:zoom:virtual_desktop_infrastructure::::::::
zoom	zoom	*	cpe:2.3:a:zoom:zoom::::::windows::*