#VU98149 Incorrect User Management in Zoom Video Communications, Inc. products - CVE-2024-45425

Vulnerability identifier: #VU98149

Vulnerability risk: Low

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

CVE-ID: CVE-2024-45425

CWE-ID: CWE-286

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
Zoom Workplace Desktop App for Windows
Zoom Workplace Desktop App for macOS
Zoom Workplace Desktop App for Linux
Zoom Rooms Client for Windows
Zoom Rooms Client for macOS
Zoom Workplace App for iOS
Zoom Workplace App for Android
Virtual Desktop Infrastructure (VDI)
Zoom Meeting SDK for Windows

Software vendor:
Zoom Video Communications, Inc.

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to incorrect user management. A remote privileged user can gain access to sensitive information.

Install updates from vendor's website.

• https://www.zoom.com/en/trust/security-bulletin/ZSB-24037/