Untrusted search path in Zoom Rooms Client for macOS and Zoom Workplace Desktop App for macOS - CVE-2024-45417
Published: November 12, 2024
Vulnerability identifier: #VU100257
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-45417
CWE-ID: CWE-426
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to usage of an untrusted search path. A local user can place a malicious binary into a specific location on the system and execute arbitrary code with escalated privileges.
Affected software
Zoom Rooms Client for macOS
Zoom Workplace Desktop App for macOS
Zoom Workplace Desktop App for macOS
How to mitigate CVE-2024-45417
Install updates from vendor's website.
Zoom Rooms Client for macOS - update to 6.1.5 7039
Zoom Workplace Desktop App for macOS - update to 6.1.5 37534
Zoom Workplace Desktop App for macOS - update to 6.1.5 37534