CVE-2024-42438 - Vulnerability Details

Vendors	Products
Zoom	Meeting Software Development Kit Rooms Rooms Controller Workplace Workplace Desktop Workplace Virtual Desktop Infrastructure

Link	Providers
https://www.zoom.com/en/trust/security-bulletin/zsb-24031

Type	Values Removed	Values Added
First Time appeared		Zoom Zoom meeting Software Development Kit Zoom rooms Zoom rooms Controller Zoom workplace Zoom workplace Desktop Zoom workplace Virtual Desktop Infrastructure
Weaknesses		CWE-787
CPEs		cpe:2.3:a:zoom:meeting_software_development_kit::::::android::* cpe:2.3:a:zoom:meeting_software_development_kit::::::iphone_os::* cpe:2.3:a:zoom:meeting_software_development_kit::::::macos::* cpe:2.3:a:zoom:meeting_software_development_kit::::::windows::* cpe:2.3:a:zoom:rooms::::::ipados::* cpe:2.3:a:zoom:rooms::::::macos::* cpe:2.3:a:zoom:rooms::::::windows::* cpe:2.3:a:zoom:rooms_controller::::::android::* cpe:2.3:a:zoom:rooms_controller::::::linux::* cpe:2.3:a:zoom:rooms_controller::::::macos::* cpe:2.3:a:zoom:rooms_controller::::::windows::* cpe:2.3:a:zoom:workplace::::::android::* cpe:2.3:a:zoom:workplace::::::iphone_os::* cpe:2.3:a:zoom:workplace_desktop::::::linux::* cpe:2.3:a:zoom:workplace_desktop::::::macos::* cpe:2.3:a:zoom:workplace_desktop::::::windows::* cpe:2.3:a:zoom:workplace_virtual_desktop_infrastructure::::::windows::*
Vendors & Products		Zoom Zoom meeting Software Development Kit Zoom rooms Zoom rooms Controller Zoom workplace Zoom workplace Desktop Zoom workplace Virtual Desktop Infrastructure

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.
Title		Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers - Buffer Overflow
Weaknesses		CWE-122
References		https://www.zoom.com/en/trust/security-bulletin/zsb-24031
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-42438", "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "state": "PUBLISHED", "assignerShortName": "Zoom", "dateReserved": "2024-08-01T19:13:16.137Z", "datePublished": "2024-08-14T16:41:18.732Z", "dateUpdated": "2024-08-16T20:05:07.811Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows", "MacOS", "Linux", "iOS", "Android"], "product": "Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers", "vendor": "Zoom Communications Inc.", "versions": [{"status": "affected", "version": "see references"}]}], "datePublic": "2024-08-13T12:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access."}], "value": "Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "shortName": "Zoom", "dateUpdated": "2024-08-14T16:41:18.732Z"}, "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/zsb-24031"}], "source": {"discovery": "UNKNOWN"}, "title": "Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers -  Buffer Overflow", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-16T20:04:49.519001Z", "id": "CVE-2024-42438", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-16T20:05:07.811Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-42438 (string)

assignerOrgId : 99b9af0d-a833-4a5d-9e2f-8b1324f35351 (string)

state : PUBLISHED (string)

assignerShortName : Zoom (string)

dateReserved : 2024-08-01T19:13:16.137Z (string)

datePublished : 2024-08-14T16:41:18.732Z (string)

dateUpdated : 2024-08-16T20:05:07.811Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

platforms : [ »

0 : Windows (string)

1 : MacOS (string)

2 : Linux (string)

3 : iOS (string)

4 : Android (string)

]

product : Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers (string)

vendor : Zoom Communications Inc. (string)

versions : [ »

0 : { »

status : affected (string)

version : see references (string)

}

]

}

]

datePublic : 2024-08-13T12:00:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access. (string)

}

]

value : Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 6.5 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : NONE (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-122 (string)

description : CWE-122 Heap-based Buffer Overflow (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 99b9af0d-a833-4a5d-9e2f-8b1324f35351 (string)

shortName : Zoom (string)

dateUpdated : 2024-08-14T16:41:18.732Z (string)

}

references : [ »

0 : { »

url : https://www.zoom.com/en/trust/security-bulletin/zsb-24031 (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers - Buffer Overflow (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-08-16T20:04:49.519001Z (string)

id : CVE-2024-42438 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-16T20:05:07.811Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-42438", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-16T20:04:49.519001Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-16T20:05:02.315Z"}}], "cna": {"title": "Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers -  Buffer Overflow", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Zoom Communications Inc.", "product": "Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers", "versions": [{"status": "affected", "version": "see references"}], "platforms": ["Windows", "MacOS", "Linux", "iOS", "Android"], "defaultStatus": "unaffected"}], "datePublic": "2024-08-13T12:00:00.000Z", "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/zsb-24031"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.", "supportingMedia": [{"type": "text/html", "value": "Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "shortName": "Zoom", "dateUpdated": "2024-08-14T16:41:18.732Z"}}}, "cveMetadata": {"cveId": "CVE-2024-42438", "state": "PUBLISHED", "dateUpdated": "2024-08-16T20:05:07.811Z", "dateReserved": "2024-08-01T19:13:16.137Z", "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "datePublished": "2024-08-14T16:41:18.732Z", "assignerShortName": "Zoom"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-42438 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-08-16T20:04:49.519001Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-08-16T20:05:02.315Z (string)

}

]

cna : { »

title : Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers - Buffer Overflow (string)

source : { »

discovery : UNKNOWN (string)

}

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 6.5 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (string)

integrityImpact : NONE (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : LOW (string)

confidentialityImpact : NONE (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Zoom Communications Inc. (string)

product : Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers (string)

versions : [ »

0 : { »

status : affected (string)

version : see references (string)

}

]

platforms : [ »

0 : Windows (string)

1 : MacOS (string)

2 : Linux (string)

3 : iOS (string)

4 : Android (string)

]

defaultStatus : unaffected (string)

}

]

datePublic : 2024-08-13T12:00:00.000Z (string)

references : [ »

0 : { »

url : https://www.zoom.com/en/trust/security-bulletin/zsb-24031 (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access. (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-122 (string)

description : CWE-122 Heap-based Buffer Overflow (string)

}

]

}

]

providerMetadata : { »

orgId : 99b9af0d-a833-4a5d-9e2f-8b1324f35351 (string)

shortName : Zoom (string)

dateUpdated : 2024-08-14T16:41:18.732Z (string)

}

cveMetadata : { »

cveId : CVE-2024-42438 (string)

state : PUBLISHED (string)

dateUpdated : 2024-08-16T20:05:07.811Z (string)

dateReserved : 2024-08-01T19:13:16.137Z (string)

assignerOrgId : 99b9af0d-a833-4a5d-9e2f-8b1324f35351 (string)

datePublished : 2024-08-14T16:41:18.732Z (string)

assignerShortName : Zoom (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zoom:meeting_software_development_kit:*:*:*:*:*:android:*:*", "matchCriteriaId": "CCF91C03-5DC9-4AC5-AB5F-36708AD86A97", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:meeting_software_development_kit:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "6E039542-3E10-4565-9543-71F50F06A933", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:meeting_software_development_kit:*:*:*:*:*:macos:*:*", "matchCriteriaId": "8629FE9D-2BFF-44F5-8E66-2702BD92E2E5", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:meeting_software_development_kit:*:*:*:*:*:windows:*:*", "matchCriteriaId": "F82C8A03-C83C-4404-84C1-D9D4836B9982", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:rooms:*:*:*:*:*:ipados:*:*", "matchCriteriaId": "9A8F4501-FF62-4C1B-9232-875D6B09B509", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:rooms:*:*:*:*:*:macos:*:*", "matchCriteriaId": "30C8F150-F275-423E-818C-B15B929FA006", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:rooms:*:*:*:*:*:windows:*:*", "matchCriteriaId": "242D5F39-22FC-4304-8F36-3A0A23BDCC6E", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:rooms_controller:*:*:*:*:*:android:*:*", "matchCriteriaId": "603C3411-C4F4-4451-BA4B-C463EC11C707", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:rooms_controller:*:*:*:*:*:linux:*:*", "matchCriteriaId": "A1D900AF-A23B-4D1C-BDE3-CE99DFFBDEBB", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:rooms_controller:*:*:*:*:*:macos:*:*", "matchCriteriaId": "B497C5C3-921E-462B-91A3-58DA2F669236", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:rooms_controller:*:*:*:*:*:windows:*:*", "matchCriteriaId": "D40263F3-4A0E-418E-AF91-8AD20A957D9F", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:workplace:*:*:*:*:*:android:*:*", "matchCriteriaId": "2C19D307-3FE4-40A2-BEE6-C04B71597D50", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:workplace:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "8FE458E6-5ACB-428D-A339-D826E5EDDAD1", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:workplace_desktop:*:*:*:*:*:linux:*:*", "matchCriteriaId": "65DD163F-BB0E-4BE3-9545-F379774F3AE4", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:workplace_desktop:*:*:*:*:*:macos:*:*", "matchCriteriaId": "29182D36-6FB9-4340-A6B9-F6F81FE57443", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:workplace_desktop:*:*:*:*:*:windows:*:*", "matchCriteriaId": "3A34FEBC-6E74-4F03-BFA7-FD37226097F1", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:workplace_virtual_desktop_infrastructure:*:*:*:*:*:windows:*:*", "matchCriteriaId": "E725630A-E7C2-4C15-BFFA-50EE34D3EE68", "versionEndExcluding": "5.17.14", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:workplace_virtual_desktop_infrastructure:*:*:*:*:*:windows:*:*", "matchCriteriaId": "61AC2191-2286-4328-9E4E-2C78E1D37734", "versionEndExcluding": "6.0.11", "versionStartIncluding": "6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Buffer overflow in some Zoom Workplace Apps, SDKs, Rooms Clients, and Rooms Controllers may allow an authenticated user to conduct a denial of service via network access."}, {"lang": "es", "value": " El desbordamiento del b\u00fafer en algunas aplicaciones, SDK, clientes de salas y controladores de salas de Zoom Workplace puede permitir que un usuario autenticado realice una denegaci\u00f3n de servicio a trav\u00e9s del acceso a la red."}], "id": "CVE-2024-42438", "lastModified": "2024-08-29T00:01:59.503", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security@zoom.us", "type": "Secondary"}]}, "published": "2024-08-14T17:15:17.317", "references": [{"source": "security@zoom.us", "tags": ["Vendor Advisory"], "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-24031"}], "sourceIdentifier": "security@zoom.us", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-122"}], "source": "security@zoom.us", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:zoom:meeting_software_development_kit:*:*:*:*:*:android:*:* (string)

matchCriteriaId : CCF91C03-5DC9-4AC5-AB5F-36708AD86A97 (string)