9.8

CVE-2024-24691

Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input Validation

Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Zoom ≫ Meeting Software Development Kit SwPlatformwindows Version < 5.16.5
Zoom ≫ Rooms SwPlatformwindows Version < 5.17.0
Zoom ≫ Vdi Windows Meeting Clients SwPlatformwindows Version < 5.14.14
Zoom ≫ Vdi Windows Meeting Clients SwPlatformwindows Version > 5.14.14 < 5.15.12
Zoom ≫ Vdi Windows Meeting Clients SwPlatformwindows Version > 5.15.12 < 5.16.10
Zoom ≫ Zoom SwPlatformwindows Version < 5.16.5
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.69% 0.741
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
security@zoom.us 9.6 2.8 6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE-176 Improper Handling of Unicode Encoding

The product does not properly handle when an input contains Unicode encoding.

https://www.zoom.com/en/trust/security-bulletin/ZSB-24008/
Vendor Advisory