CVE-2024-24698 - Vulnerability Details

Vendors	Products
Zoom	Meeting Software Development Kit Rooms Vdi Windows Meeting Clients Zoom

Link	Providers
https://www.zoom.com/en/trust/security-bulletin/ZSB-24005/

Type	Values Removed	Values Added
First Time appeared		Zoom Zoom meeting Software Development Kit Zoom rooms Zoom vdi Windows Meeting Clients Zoom zoom
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:zoom:meeting_software_development_kit::::::windows::* cpe:2.3:a:zoom:rooms::::::windows::* cpe:2.3:a:zoom:vdi_windows_meeting_clients::::::windows::* cpe:2.3:a:zoom:zoom::::::android::* cpe:2.3:a:zoom:zoom::::::iphone_os::* cpe:2.3:a:zoom:zoom::::::linux::* cpe:2.3:a:zoom:zoom::::::macos::* cpe:2.3:a:zoom:zoom::::::windows::*
Vendors & Products		Zoom Zoom meeting Software Development Kit Zoom rooms Zoom vdi Windows Meeting Clients Zoom zoom

Type	Values Removed	Values Added
Weaknesses	CWE-287
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description	Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access.	Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access.
Weaknesses		CWE-449

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-24698", "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "state": "PUBLISHED", "assignerShortName": "Zoom", "dateReserved": "2024-01-26T22:56:14.681Z", "datePublished": "2024-02-13T23:56:14.515Z", "dateUpdated": "2024-09-27T19:28:28.333Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows", "iOS", "Linux", "Android"], "product": "Zoom Clients", "vendor": "Zoom Video Communications, Inc.", "versions": [{"status": "affected", "version": "see references"}]}], "datePublic": "2024-02-13T13:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access.<br>"}], "value": "Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-449", "description": "CWE-449: The UI Performs the Wrong Action", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "shortName": "Zoom", "dateUpdated": "2024-09-27T19:28:28.333Z"}, "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-24005/"}], "source": {"discovery": "UNKNOWN"}, "title": "Zoom Clients  - Improper Authentication", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-24698", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-14T15:30:17.531210Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:43:32.245Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:28:11.903Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-24005/", "tags": ["x_transferred"]}]}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-24698 (string)

assignerOrgId : 99b9af0d-a833-4a5d-9e2f-8b1324f35351 (string)

state : PUBLISHED (string)

assignerShortName : Zoom (string)

dateReserved : 2024-01-26T22:56:14.681Z (string)

datePublished : 2024-02-13T23:56:14.515Z (string)

dateUpdated : 2024-09-27T19:28:28.333Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

platforms : [ »

0 : Windows (string)

1 : iOS (string)

2 : Linux (string)

3 : Android (string)

]

product : Zoom Clients (string)

vendor : Zoom Video Communications, Inc. (string)

versions : [ »

0 : { »

status : affected (string)

version : see references (string)

}

]

}

]

datePublic : 2024-02-13T13:00:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access.<br> (string)

}

]

value : Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.9 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-449 (string)

description : CWE-449: The UI Performs the Wrong Action (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 99b9af0d-a833-4a5d-9e2f-8b1324f35351 (string)

shortName : Zoom (string)

dateUpdated : 2024-09-27T19:28:28.333Z (string)

}

references : [ »

0 : { »

url : https://www.zoom.com/en/trust/security-bulletin/ZSB-24005/ (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : Zoom Clients - Improper Authentication (string)

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-24698 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-02-14T15:30:17.531210Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-06-04T17:43:32.245Z (string)

}

1 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-01T23:28:11.903Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.zoom.com/en/trust/security-bulletin/ZSB-24005/ (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-24005/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:28:11.903Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-24698", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-14T15:30:17.531210Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:11.361Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Zoom Clients  - Improper Authentication", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Zoom Video Communications, Inc.", "product": "Zoom Clients", "versions": [{"status": "affected", "version": "see references"}], "platforms": ["Windows", "iOS", "Linux", "Android"], "defaultStatus": "unaffected"}], "datePublic": "2024-02-13T13:00:00.000Z", "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-24005/"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access.", "supportingMedia": [{"type": "text/html", "value": "Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-449", "description": "CWE-449: The UI Performs the Wrong Action"}]}], "providerMetadata": {"orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "shortName": "Zoom", "dateUpdated": "2024-09-27T19:28:28.333Z"}}}, "cveMetadata": {"cveId": "CVE-2024-24698", "state": "PUBLISHED", "dateUpdated": "2024-09-27T19:28:28.333Z", "dateReserved": "2024-01-26T22:56:14.681Z", "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "datePublished": "2024-02-13T23:56:14.515Z", "assignerShortName": "Zoom"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://www.zoom.com/en/trust/security-bulletin/ZSB-24005/ (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-01T23:28:11.903Z (string)

}

1 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-24698 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-02-14T15:30:17.531210Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-05-23T19:01:11.361Z (string)

}

title : CISA ADP Vulnrichment (string)

}

]

cna : { »

title : Zoom Clients - Improper Authentication (string)

source : { »

discovery : UNKNOWN (string)

}

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.9 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : HIGH (string)

confidentialityImpact : HIGH (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Zoom Video Communications, Inc. (string)

product : Zoom Clients (string)

versions : [ »

0 : { »

status : affected (string)

version : see references (string)

}

]

platforms : [ »

0 : Windows (string)

1 : iOS (string)

2 : Linux (string)

3 : Android (string)

]

defaultStatus : unaffected (string)

}

]

datePublic : 2024-02-13T13:00:00.000Z (string)

references : [ »

0 : { »

url : https://www.zoom.com/en/trust/security-bulletin/ZSB-24005/ (string)

}

]

x_generator : { »

engine : Vulnogram 0.1.0-dev (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access.<br> (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-449 (string)

description : CWE-449: The UI Performs the Wrong Action (string)

}

]

}

]

providerMetadata : { »

orgId : 99b9af0d-a833-4a5d-9e2f-8b1324f35351 (string)

shortName : Zoom (string)

dateUpdated : 2024-09-27T19:28:28.333Z (string)

}

cveMetadata : { »

cveId : CVE-2024-24698 (string)

state : PUBLISHED (string)

dateUpdated : 2024-09-27T19:28:28.333Z (string)

dateReserved : 2024-01-26T22:56:14.681Z (string)

assignerOrgId : 99b9af0d-a833-4a5d-9e2f-8b1324f35351 (string)

datePublished : 2024-02-13T23:56:14.515Z (string)

assignerShortName : Zoom (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zoom:meeting_software_development_kit:*:*:*:*:*:windows:*:*", "matchCriteriaId": "ED921F3E-F076-4037-BAE9-53BDC04F2A4C", "versionEndExcluding": "5.17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:rooms:*:*:*:*:*:windows:*:*", "matchCriteriaId": "9D60A59A-2E09-48C6-82F6-995B7ADB330A", "versionEndExcluding": "5.17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:vdi_windows_meeting_clients:*:*:*:*:*:windows:*:*", "matchCriteriaId": "6C7B8981-66F8-4309-98C6-63B4665229EF", "versionEndExcluding": "5.15.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:vdi_windows_meeting_clients:*:*:*:*:*:windows:*:*", "matchCriteriaId": "FDCC89D1-EB4D-496D-82C6-B0BBA942286F", "versionEndExcluding": "5.16.12", "versionStartExcluding": "5.15.15", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:vdi_windows_meeting_clients:*:*:*:*:*:windows:*:*", "matchCriteriaId": "ECD4FC8B-5FB2-4667-B92F-26F2A951EE40", "versionEndExcluding": "5.17.5", "versionStartExcluding": "5.16.12", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:zoom:*:*:*:*:*:android:*:*", "matchCriteriaId": "BA20AF82-C1DF-4C05-91ED-F5DC1A92C0A3", "versionEndExcluding": "5.17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:zoom:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "D5C425F2-9B12-4E3A-88CD-BD7AC0EEB0F6", "versionEndExcluding": "5.17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:zoom:*:*:*:*:*:linux:*:*", "matchCriteriaId": "5E7DB9AA-DB7D-4F3F-A7EA-A482F328F8AB", "versionEndExcluding": "5.17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:zoom:*:*:*:*:*:macos:*:*", "matchCriteriaId": "6E5232D6-0338-4FCC-AB49-39EA6B75B91D", "versionEndExcluding": "5.17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:zoom:*:*:*:*:*:windows:*:*", "matchCriteriaId": "8ED34AF6-F5F5-45A1-8AF1-C85064789454", "versionEndExcluding": "5.17.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access."}, {"lang": "es", "value": "La autenticaci\u00f3n inadecuada en algunos clientes de Zoom puede permitir que un usuario privilegiado realice una divulgaci\u00f3n de informaci\u00f3n a trav\u00e9s del acceso local."}], "id": "CVE-2024-24698", "lastModified": "2024-11-21T08:59:31.897", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security@zoom.us", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-02-14T00:15:47.967", "references": [{"source": "security@zoom.us", "tags": ["Vendor Advisory"], "url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-24005/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-24005/"}], "sourceIdentifier": "security@zoom.us", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-449"}], "source": "security@zoom.us", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:zoom:meeting_software_development_kit:*:*:*:*:*:windows:*:* (string)

matchCriteriaId : ED921F3E-F076-4037-BAE9-53BDC04F2A4C (string)

versionEndExcluding : 5.17.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:zoom:rooms:*:*:*:*:*:windows:*:* (string)

matchCriteriaId : 9D60A59A-2E09-48C6-82F6-995B7ADB330A (string)

versionEndExcluding : 5.17.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:zoom:vdi_windows_meeting_clients:*:*:*:*:*:windows:*:* (string)

matchCriteriaId : 6C7B8981-66F8-4309-98C6-63B4665229EF (string)

versionEndExcluding : 5.15.5 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:zoom:vdi_windows_meeting_clients:*:*:*:*:*:windows:*:* (string)

matchCriteriaId : FDCC89D1-EB4D-496D-82C6-B0BBA942286F (string)

versionEndExcluding : 5.16.12 (string)

versionStartExcluding : 5.15.15 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:zoom:vdi_windows_meeting_clients:*:*:*:*:*:windows:*:* (string)

matchCriteriaId : ECD4FC8B-5FB2-4667-B92F-26F2A951EE40 (string)

versionEndExcluding : 5.17.5 (string)

versionStartExcluding : 5.16.12 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:zoom:zoom:*:*:*:*:*:android:*:* (string)

matchCriteriaId : BA20AF82-C1DF-4C05-91ED-F5DC1A92C0A3 (string)

versionEndExcluding : 5.17.0 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:zoom:zoom:*:*:*:*:*:iphone_os:*:* (string)

matchCriteriaId : D5C425F2-9B12-4E3A-88CD-BD7AC0EEB0F6 (string)

versionEndExcluding : 5.17.0 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:a:zoom:zoom:*:*:*:*:*:linux:*:* (string)

matchCriteriaId : 5E7DB9AA-DB7D-4F3F-A7EA-A482F328F8AB (string)

versionEndExcluding : 5.17.0 (string)

vulnerable : true (boolean)

}

8 : { »

criteria : cpe:2.3:a:zoom:zoom:*:*:*:*:*:macos:*:* (string)

matchCriteriaId : 6E5232D6-0338-4FCC-AB49-39EA6B75B91D (string)

versionEndExcluding : 5.17.0 (string)

vulnerable : true (boolean)

}

9 : { »

criteria : cpe:2.3:a:zoom:zoom:*:*:*:*:*:windows:*:* (string)

matchCriteriaId : 8ED34AF6-F5F5-45A1-8AF1-C85064789454 (string)

versionEndExcluding : 5.17.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Improper authentication in some Zoom clients may allow a privileged user to conduct a disclosure of information via local access. (string)

}

1 : { »

lang : es (string)

value : La autenticación inadecuada en algunos clientes de Zoom puede permitir que un usuario privilegiado realice una divulgación de información a través del acceso local. (string)

}

]

id : CVE-2024-24698 (string)

lastModified : 2024-11-21T08:59:31.897 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.9 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.2 (number)

impactScore : 3.6 (number)

source : security@zoom.us (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : NONE (string)

baseScore : 4.4 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 0.8 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2024-02-14T00:15:47.967 (string)

references : [ »

0 : { »

source : security@zoom.us (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.zoom.com/en/trust/security-bulletin/ZSB-24005/ (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Vendor Advisory (string)

]

url : https://www.zoom.com/en/trust/security-bulletin/ZSB-24005/ (string)

}

]

sourceIdentifier : security@zoom.us (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-449 (string)

}

]

source : security@zoom.us (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-noinfo (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object