PT-2023-4700 · Zoom · Zoom Vdi Client+1

Published 2023-08-08 · Updated 2024-09-27 · CVE-2023-39213

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zoom Desktop Client for Windows versions prior to 5.15.2 Zoom VDI Client versions prior to 5.15.2

Description The issue exists due to improper neutralization of special elements, which may allow an unauthenticated user to enable an escalation of privilege via network access. This can be exploited by a remote attacker to elevate their privileges.

Recommendations For Zoom Desktop Client for Windows versions prior to 5.15.2, update to version 5.15.2 or later to resolve the issue. For Zoom VDI Client versions prior to 5.15.2, update to version 5.15.2 or later to resolve the issue. As a temporary workaround, consider restricting network access to minimize the risk of exploitation.

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

CWE-176

Related Identifiers

BDU:2023-05124

CVE-2023-39213

Affected Products

Zoom Desktop Client For Windows

Zoom Vdi Client

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2023-39213 · Security Note
• https://bdu.fstec.ru/vul/2023-05124 · Security Note
• https://explore.zoom.us/en/trust/security/security-bulletin · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39213 · Vendor Advisory
• https://t.me/cvenotify/56035 · Telegram Post
• https://t.me/cvenotify/96435 · Telegram Post
• https://twitter.com/PanMinori/status/1690900658906619904 · Twitter Post
• https://t.me/cvenotify/56090 · Telegram Post
• https://twitter.com/RsSI47041968/status/1689709972458979328 · Twitter Post