PT-2023-2170 · Zoom · Zoom Client For It Admin

CVE-2023-28596 · Publicado 2023-03-14 · Atualizado 2023-04-03

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoom Client for IT Admin macOS installers versions prior to 5.13.5

Description The issue is related to a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain during the installation process to escalate their privileges to root. The vulnerability is also associated with an uncontrolled search path element.

Recommendations For versions prior to 5.13.5, update to version 5.13.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the installation process to minimize the risk of exploitation.

Correção

Uncontrolled Search Path Element

Enumeração de Fraquezas

CWE-427

Identificadores relacionados

BDU:2023-01912

CVE-2023-28596

Produtos afetados

Zoom Client For It Admin

Referências · 8

• https://t.me/cvenotify/47424 · Publicação no Telegram
• https://support.zoom.us/hc/en-us/articles/207373866-Zoom-Installers · Nota
• https://github.com/advisories/GHSA-4hfv-g3hm-82x2 · Nota
• https://t.me/cibsecurity/60836 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-28596 · Aviso do Fabricante
• https://explore.zoom.us/en/trust/security/security-bulletin · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-28596 · Nota de Segurança
• https://bdu.fstec.ru/vul/2023-01912 · Nota de Segurança