Information disclosure in Zoom Video Communications, Inc. products - CVE-2024-45424

Vulnerability identifier: #VU96905

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-45424

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a business logic error. A remote attacker can gain unauthorized access to sensitive information.

Zoom Workplace App for iOS
Zoom Workplace App for Android
Zoom Workplace Desktop App for Windows
Zoom Workplace Desktop App for macOS
Zoom Workplace Desktop App for Linux

Install updates from vendor's website.

Zoom Workplace App for iOS - update to 6.1.0 16182
Zoom Workplace Desktop App for Windows - update to 6.1.0 41135
Zoom Workplace Desktop App for macOS - update to 6.1.0 35886
Zoom Workplace App for Android - update to 6.1.0 22482
Zoom Workplace Desktop App for Linux - update to 6.1.0 198

• https://www.zoom.com/en/trust/security-bulletin/ZSB-24036/

• Information disclosure in Zoom Workplace Apps