9.8

CVE-2024-24691

Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows may allow an unauthenticated user to conduct an escalation of privilege via network access.

Data is provided by the National Vulnerability Database (NVD)
Zoom ≫ Meeting Software Development Kit SwPlatformwindows Version < 5.16.5
Zoom ≫ Rooms SwPlatformwindows Version < 5.17.0
Zoom ≫ Vdi Windows Meeting Clients SwPlatformwindows Version < 5.14.14
Zoom ≫ Vdi Windows Meeting Clients SwPlatformwindows Version > 5.14.14 < 5.15.12
Zoom ≫ Vdi Windows Meeting Clients SwPlatformwindows Version > 5.15.12 < 5.16.10
Zoom ≫ Zoom SwPlatformwindows Version < 5.16.5
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.47% 0.634
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
security@zoom.us 9.6 2.8 6
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CWE-176 Improper Handling of Unicode Encoding

The product does not properly handle when an input contains Unicode encoding.