Lucene search

ZoomCVE-2023-39202

HistoryNov 14, 2023 - 11:15 p.m.

CVE-2023-39202

2023-11-1423:15:08

CWE-426

Zoom

web.nvd.nist.gov

zoom

windows

vdi

client

denial of service

cve-2023-39202

untrusted search path

nvd

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

5.3

Confidence

High

EPSS

Percentile

12.7%

JSON

Untrusted search path in Zoom Rooms Client for Windows and Zoom VDI Client may allow a privileged user to conduct a denial of service via local access.

Affected configurations

Nvd

Node

zoomroomsRange<5.16.0windows

zoomvirtual_desktop_infrastructureRange<5.14.13

zoomvirtual_desktop_infrastructureRange5.15.0–5.15.11

VendorProductVersionCPE
zoomrooms*cpe:2.3:a:zoom:rooms:*:*:*:*:*:windows:*:*
zoomvirtual_desktop_infrastructure*cpe:2.3:a:zoom:virtual_desktop_infrastructure:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zoom	rooms	*	cpe:2.3:a:zoom:rooms::::::windows::*
zoom	virtual_desktop_infrastructure	*	cpe:2.3:a:zoom:virtual_desktop_infrastructure::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "platforms": [
      "Windows"
    ],
    "product": "Zoom Rooms Client for Windows and Zoom VDI Client",
    "vendor": "Zoom Video Communications, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "see references"
      }
    ]
  }
]

References

explore.zoom.us/en/trust/security/security-bulletin/

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

AI Score

5.3

Confidence

High

EPSS

Percentile

12.7%

JSON

Related for CVE-2023-39202