CVE-2023-39216criticalCWE-80

CVE-2023-39216: critical vulnerability in Zoom Desktop Client for Windows

Published · Updated

Follow this CVE+ Monitor Zoom Desktop Client

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.6epss 1.2%
In short

Zoom Desktop Client for Windows before version 5.14.7 has a flaw that fails to properly check user input, allowing someone on the network to gain higher privileges without needing to log in first.

Technical detail

Improper input validation in Zoom Desktop Client for Windows (pre-5.14.7) enables privilege escalation via network access without authentication. The vulnerability stems from insufficient validation of user-supplied input (CWE-80), allowing an unauthenticated attacker on the network to exploit the flaw and elevate their privileges on the affected system.

Summary generated and translated by AI from the official description.
Improper input validation in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privilege via network access.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected products
Zoom Video Communications, Inc. · Zoom Desktop Client for Windows
Related CVEs — Zoom Desktop Client for Windows

In the same product, most dangerous first.

CVE-2023-36534CRITICALCVE-2023-36534EPSS 1.6%CVE-2023-39209MEDIUMCVE-2023-39209EPSS 1.0%CVE-2023-34116HIGHCVE-2023-34116EPSS 1.0%CVE-2023-36541HIGHCVE-2023-36541EPSS 0.5%CVE-2023-36540HIGHCVE-2023-36540EPSS 0.3%CVE-2024-24694MEDIUMZoom Desktop Client for Windows - Improper Privilege ManagementEPSS 0.2%