Information disclosure in Zoom Workplace Apps

Published: 2024-10-08

Risk	Low
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2024-45425 CVE-2024-45426
CWE-ID	CWE-286 CWE-708
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Zoom Workplace Desktop App for Windows Client/Desktop applications / Office applications Zoom Workplace Desktop App for macOS Client/Desktop applications / Office applications Zoom Workplace Desktop App for Linux Client/Desktop applications / Office applications Zoom Rooms for Windows Client/Desktop applications / Office applications Zoom Workplace App for iOS Mobile applications / Apps for mobile phones Zoom Workplace App for Android Mobile applications / Apps for mobile phones Zoom Rooms for macOS Client/Desktop applications / Messaging software Virtual Desktop Infrastructure (VDI) Server applications / Conferencing, Collaboration and VoIP solutions Zoom Meeting SDK for Windows Universal components / Libraries / Software for developers
Vendor	Zoom Video Communications, Inc.

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Incorrect User Management

EUVDB-ID: #VU98149

Risk: Low

CVSSv3.1: 2.4 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-45425

CWE-ID: CWE-286 - Incorrect User Management

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to incorrect user management. A remote privileged user can gain access to sensitive information.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Zoom Workplace Desktop App for Windows: 5.0.0 23168.0427 - 6.0.12 22226

Zoom Workplace Desktop App for macOS: 5.0.0 23186.0427 - 6.0.11 35001

Zoom Workplace Desktop App for Linux: 5.1.418436.0628 - 6.0.12 5501

Zoom Workplace App for iOS: 5.0.0 23161.0427 - 6.0.12 15866

Zoom Workplace App for Android: 5.0.1 23478.0429 - 6.0.12 22225

Zoom Rooms for Windows: 5.0.0 1420.0426 - 6.0.7

Zoom Rooms for macOS: 5.0.0 2236.0426 - 6.0.6 6225

Virtual Desktop Infrastructure (VDI): 5.0.1 - 6.0.11

Zoom Meeting SDK for Windows: 5.9.0 - 6.0.11

CPE2.3

External links

http://www.zoom.com/en/trust/security-bulletin/ZSB-24037/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website or open a file.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Incorrect Ownership Assignment

EUVDB-ID: #VU98150