PT-2020-3655 · Zoom · Zoom Client+1

Published 2020-06-08 · Updated 2022-05-12 · CVE-2020-6110

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoom Client version 4.6.10

Description An exploitable partial path traversal issue exists in the way Zoom Client processes messages including shared code snippets. A specially crafted chat message can cause an arbitrary binary planting which could be abused to achieve arbitrary code execution. An attacker needs to send a specially crafted message to a target user or a group to trigger this issue. For the most severe effect, target user interaction is required.

Recommendations For Zoom Client version 4.6.10, consider disabling the shared code snippets feature until a patch is available. Restrict access to chat messages that include shared code snippets to minimize the risk of exploitation. Avoid using shared code snippets in chat messages until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2020-04003

CVE-2020-6110

Affected Products

Zoom Client

Zoom

References · 9

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2020-1056 · Exploit
• https://osv.dev/vulnerability/CVE-2020-6110 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04003 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-6110 · Security Note
• https://securitylab.ru/vulnerability/508895.php · Note
• https://cybersecurity-help.cz/vdb/SB2020060408 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-6110 · Note
• https://xakep.ru/2020/06/04/zoom-e2e · Note
• https://t.me/cvenotify/4241 · Telegram Post