CVE-2024-24696

Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to conduct a disclosure of information via network access.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.zoom.com/en/trust/security-bulletin/ZSB-24003/	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:zoom:meeting_software_development_kit::::::windows::*
	cpe:2.3:a:zoom:vdi_windows_meeting_clients::::::windows::*
	cpe:2.3:a:zoom:vdi_windows_meeting_clients::::::windows::*
	cpe:2.3:a:zoom:vdi_windows_meeting_clients::::::windows::*
	cpe:2.3:a:zoom:zoom::::::windows::*

History

04 Oct 2024, 14:33

Type	Values Removed	Values Added
CWE		NVD-CWE-noinfo
CVSS	v2 : ~~unknown~~ v3 : ~~6.8~~	v2 : unknown v3 : 6.5
CPE		cpe:2.3:a:zoom:zoom::::::windows::* cpe:2.3:a:zoom:meeting_software_development_kit::::::windows::* cpe:2.3:a:zoom:vdi_windows_meeting_clients::::::windows::*
First Time		Zoom zoom Zoom meeting Software Development Kit Zoom Zoom vdi Windows Meeting Clients
Summary		(es) Una validación de entrada incorrecta en Zoom Desktop Client para Windows, Zoom VDI Client para Windows y Zoom Meeting SDK para Windows puede permitir que un usuario autenticado realice una divulgación de información a través del acceso a la red.
References	~~() https://www.zoom.com/en/trust/security-bulletin/ZSB-24003/ -~~	() https://www.zoom.com/en/trust/security-bulletin/ZSB-24003/ - Vendor Advisory

14 Feb 2024, 00:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-02-14 00:15

Updated : 2024-10-04 14:33

NVD link : CVE-2024-24696

Mitre link : CVE-2024-24696

CVE.ORG link : CVE-2024-24696

JSON object : View

Products Affected

zoom

zoom
vdi_windows_meeting_clients
meeting_software_development_kit

CWE

NVD-CWE-noinfo CWE-20

Improper Input Validation

{"id": "CVE-2024-24696", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "security@zoom.us", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 4.0, "exploitabilityScore": 2.3}]}, "published": "2024-02-14T00:15:47.583", "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-24003/", "tags": ["Vendor Advisory"], "source": "security@zoom.us"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "security@zoom.us", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an authenticated user to conduct a disclosure of information via network access.\n\n"}, {"lang": "es", "value": "Una validaci\u00f3n de entrada incorrecta en Zoom Desktop Client para Windows, Zoom VDI Client para Windows y Zoom Meeting SDK para Windows puede permitir que un usuario autenticado realice una divulgaci\u00f3n de informaci\u00f3n a trav\u00e9s del acceso a la red."}], "lastModified": "2024-10-04T14:33:50.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zoom:meeting_software_development_kit:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "ED921F3E-F076-4037-BAE9-53BDC04F2A4C", "versionEndExcluding": "5.17.0"}, {"criteria": "cpe:2.3:a:zoom:vdi_windows_meeting_clients:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "B91935BE-F245-4ADD-A206-D318618BAA1D", "versionEndExcluding": "5.15.15"}, {"criteria": "cpe:2.3:a:zoom:vdi_windows_meeting_clients:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "FDCC89D1-EB4D-496D-82C6-B0BBA942286F", "versionEndExcluding": "5.16.12", "versionStartExcluding": "5.15.15"}, {"criteria": "cpe:2.3:a:zoom:vdi_windows_meeting_clients:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "19A21230-8A49-434E-840A-2FB9096B0370", "versionEndExcluding": "5.17.0", "versionStartExcluding": "5.16.12"}, {"criteria": "cpe:2.3:a:zoom:zoom:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "8ED34AF6-F5F5-45A1-8AF1-C85064789454", "versionEndExcluding": "5.17.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@zoom.us"}