Incorrect Ownership Assignment in Zoom Video Communications, Inc. products - CVE-2024-45426

Vulnerability identifier: #VU98150

CSH Severity: Low

CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-45426

CWE-ID: CWE-708

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to gain access to sensitive information.

The vulnerability exists due to incorrect ownership assignment. A remote privileged user can gain access to sensitive information.

Zoom Rooms Client for Windows
Zoom Rooms Client for macOS
Zoom Workplace Desktop App for Windows
Zoom Workplace Desktop App for macOS
Zoom Workplace Desktop App for Linux
Zoom Workplace App for iOS
Zoom Workplace App for Android
Virtual Desktop Infrastructure (VDI)
Zoom Meeting SDK for Windows

Install updates from vendor's website.

Zoom Rooms Client for Windows - update to 6.1.0
Zoom Rooms Client for macOS - update to 6.1.0 6810
Zoom Workplace App for iOS - update to 6.1.0 16182
Zoom Workplace Desktop App for Windows - update to 6.1.0 41135
Zoom Workplace Desktop App for macOS - update to 6.1.0 35886
Virtual Desktop Infrastructure (VDI) - update to 6.1.0
Zoom Workplace App for Android - update to 6.1.0 22482
Zoom Workplace Desktop App for Linux - update to 6.1.0 198
Zoom Meeting SDK for Windows - update to 6.1.0

• https://www.zoom.com/en/trust/security-bulletin/ZSB-24038/

• Information disclosure in Zoom Workplace Apps