Paper/Archive/CVE-2023-39213

CVE-2023-39213

Zoom Video Communications, Inc. Zoom Desktop Client for Windows and Zoom VDI Client — Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before 5.15.2 may allow an unauthentic…

EPSS 1%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 73.3.733 × 2014.7 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before 5.15.2 may allow an unauthenticated user to enable an escalation of privilege via network access.

Affected

ProductAffectedFixed inSource

Zoom Desktop Client for Windows and Zoom VDI Clientbefore 5.15.2–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Zoom (CNA)9.6CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refexplore.zoom.us/en/trust/security/security-bulletin