Path traversal in Zoom Workplace Desktop App for Windows - CVE-2024-39826
Published: July 9, 2024
Vulnerability identifier: #VU93888
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-39826
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can trick the victim to click on a specially crafted URL and read contests of arbitrary files on the system.
Affected software
Zoom Workplace Desktop App for Windows
Zoom Meeting SDK for Windows
Virtual Desktop Infrastructure (VDI)
Zoom Meeting SDK for Windows
Virtual Desktop Infrastructure (VDI)
How to mitigate CVE-2024-39826
Install update from vendor's website.
Zoom Workplace Desktop App for Windows - update to 6.0.0 37205
Zoom Meeting SDK for Windows - update to 6.0.0
Virtual Desktop Infrastructure (VDI) - update to 5.17.13
Zoom Meeting SDK for Windows - update to 6.0.0
Virtual Desktop Infrastructure (VDI) - update to 5.17.13