OpenCVE

Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Zoom	Meeting Sdk Rooms Vdi Windows Meeting Clients Zoom

Configuration 1 [-]

OR	cpe:2.3:a:zoom:meeting_sdk::::::::
	cpe:2.3:a:zoom:rooms::::::::
	cpe:2.3:a:zoom:vdi_windows_meeting_clients::::::windows::*
	cpe:2.3:a:zoom:vdi_windows_meeting_clients::::::windows::*
	cpe:2.3:a:zoom:vdi_windows_meeting_clients::::::windows::*
	cpe:2.3:a:zoom:zoom::::::android::*
	cpe:2.3:a:zoom:zoom::::::iphone_os::*
	cpe:2.3:a:zoom:zoom::::::linux::*
	cpe:2.3:a:zoom:zoom::::::macos::*
	cpe:2.3:a:zoom:zoom::::::windows::*

No data.

References

Link	Providers
https://www.zoom.com/en/trust/security-bulletin/ZSB-24006/

History

Fri, 04 Oct 2024 17:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Zoom Zoom meeting Sdk Zoom rooms Zoom vdi Windows Meeting Clients Zoom zoom
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:zoom:meeting_sdk:::::::: cpe:2.3:a:zoom:rooms:::::::: cpe:2.3:a:zoom:vdi_windows_meeting_clients::::::windows::* cpe:2.3:a:zoom:zoom::::::android::* cpe:2.3:a:zoom:zoom::::::iphone_os::* cpe:2.3:a:zoom:zoom::::::linux::* cpe:2.3:a:zoom:zoom::::::macos::* cpe:2.3:a:zoom:zoom::::::windows::*
Vendors & Products		Zoom Zoom meeting Sdk Zoom rooms Zoom vdi Windows Meeting Clients Zoom zoom

MITRE

Status: PUBLISHED

Assigner: Zoom

Published: 2024-02-13T23:58:44.327Z

Updated: 2024-08-01T23:28:11.153Z

Reserved: 2024-01-26T22:56:14.681Z

Link: CVE-2024-24699

Vulnrichment

Updated: 2024-08-01T23:28:11.153Z

NVD

Status : Modified

Published: 2024-02-14T00:15:48.150

Modified: 2024-11-21T08:59:32.053

Link: CVE-2024-24699

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-24699", "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "state": "PUBLISHED", "assignerShortName": "Zoom", "dateReserved": "2024-01-26T22:56:14.681Z", "datePublished": "2024-02-13T23:58:44.327Z", "dateUpdated": "2024-08-01T23:28:11.153Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows", "iOS", "Linux", "Android"], "product": "Zoom Clients", "vendor": "Zoom Video Communications, Inc.", "versions": [{"status": "affected", "version": "see references"}]}], "datePublic": "2024-02-13T13:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access.<br>"}], "value": "Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access.\n"}], "impacts": [{"capecId": "CAPEC-441", "descriptions": [{"lang": "en", "value": "CAPEC-441 Malicious Logic Insertion"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"description": "Business Logic Error", "lang": "en"}]}], "providerMetadata": {"orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "shortName": "Zoom", "dateUpdated": "2024-02-13T23:58:44.327Z"}, "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-24006/"}], "source": {"discovery": "UNKNOWN"}, "title": "Zoom Clients - Business Logic Error", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-24699", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-14T14:00:35.091787Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:43:37.883Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:28:11.153Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-24006/", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-24006/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T23:28:11.153Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-24699", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-02-14T14:00:35.091787Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-23T19:01:11.346Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Zoom Clients - Business Logic Error", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-441", "descriptions": [{"lang": "en", "value": "CAPEC-441 Malicious Logic Insertion"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Zoom Video Communications, Inc.", "product": "Zoom Clients", "versions": [{"status": "affected", "version": "see references"}], "platforms": ["Windows", "iOS", "Linux", "Android"], "defaultStatus": "unaffected"}], "datePublic": "2024-02-13T13:00:00.000Z", "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-24006/"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access.\n", "supportingMedia": [{"type": "text/html", "value": "Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Business Logic Error"}]}], "providerMetadata": {"orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "shortName": "Zoom", "dateUpdated": "2024-02-13T23:58:44.327Z"}}}, "cveMetadata": {"cveId": "CVE-2024-24699", "state": "PUBLISHED", "dateUpdated": "2024-08-01T23:28:11.153Z", "dateReserved": "2024-01-26T22:56:14.681Z", "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "datePublished": "2024-02-13T23:58:44.327Z", "assignerShortName": "Zoom"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zoom:meeting_sdk:*:*:*:*:*:*:*:*", "matchCriteriaId": "7AF19578-CD2C-40F8-9A97-7979CB9091DC", "versionEndExcluding": "5.16.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:rooms:*:*:*:*:*:*:*:*", "matchCriteriaId": "61CCEE1E-F3C0-41EB-8DF2-4D3EA8600166", "versionEndExcluding": "5.17.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:vdi_windows_meeting_clients:*:*:*:*:*:windows:*:*", "matchCriteriaId": "B91935BE-F245-4ADD-A206-D318618BAA1D", "versionEndExcluding": "5.15.15", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:vdi_windows_meeting_clients:*:*:*:*:*:windows:*:*", "matchCriteriaId": "517DE939-52E8-4AA5-A987-F18931242DD1", "versionEndExcluding": "5.16.10", "versionStartExcluding": "5.15.15", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:vdi_windows_meeting_clients:*:*:*:*:*:windows:*:*", "matchCriteriaId": "5C5BD790-A2A7-4089-AF42-1FC13E0087D5", "versionEndExcluding": "5.17.5", "versionStartExcluding": "5.16.10", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:zoom:*:*:*:*:*:android:*:*", "matchCriteriaId": "F0EA451C-C4DC-48EF-A036-3EEA3E3ADD80", "versionEndExcluding": "5.16.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:zoom:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "C2BF4129-CA54-4ECB-9A6B-EC28445233DF", "versionEndExcluding": "5.16.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:zoom:*:*:*:*:*:linux:*:*", "matchCriteriaId": "AD4CD81C-1F22-45CA-8AB1-D6D59E819759", "versionEndExcluding": "5.16.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:zoom:*:*:*:*:*:macos:*:*", "matchCriteriaId": "BB9276FF-17D3-4FDB-91BB-2CE6E8BA61A0", "versionEndExcluding": "5.16.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:zoom:*:*:*:*:*:windows:*:*", "matchCriteriaId": "19B08EB3-7EBF-416F-91B9-4600E47567F7", "versionEndExcluding": "5.16.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Business logic error in some Zoom clients may allow an authenticated user to conduct information disclosure via network access.\n"}, {"lang": "es", "value": "Un error de l\u00f3gica empresarial en algunos clientes de Zoom puede permitir que un usuario autenticado realice la divulgaci\u00f3n de informaci\u00f3n a trav\u00e9s del acceso a la red."}], "id": "CVE-2024-24699", "lastModified": "2024-11-21T08:59:32.053", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@zoom.us", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-02-14T00:15:48.150", "references": [{"source": "security@zoom.us", "tags": ["Vendor Advisory"], "url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-24006/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-24006/"}], "sourceIdentifier": "security@zoom.us", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}