CVE-2024-45425 - Vulnerability Details - OpenCVE

Incorrect user management in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00046.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://www.zoom.com/en/trust/security-bulletin/zsb-24037/

History

Tue, 04 Mar 2025 03:45:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 25 Feb 2025 19:45:00 +0000

Type	Values Removed	Values Added
Description		Incorrect user management in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.
Title		Zoom Workplace Apps - Incorrect User Management
Weaknesses		CWE-286
References		https://www.zoom.com/en/trust/security-bulletin/zsb-24037/
Metrics		cvssV3_1 `{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: Zoom

Published: 2025-02-25T19:38:02.925Z

Updated: 2025-02-26T16:57:20.637Z

Reserved: 2024-08-28T21:50:25.333Z

Link: CVE-2024-45425

Vulnrichment

Updated: 2025-02-26T16:55:44.933Z

NVD

Status : Received

Published: 2025-02-25T20:15:35.753

Modified: 2025-02-25T20:15:35.753

Link: CVE-2024-45425

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-45425", "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "state": "PUBLISHED", "assignerShortName": "Zoom", "dateReserved": "2024-08-28T21:50:25.333Z", "datePublished": "2025-02-25T19:38:02.925Z", "dateUpdated": "2025-02-26T16:57:20.637Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows", "MacOS", "Linux", "iOS", "Android"], "product": "Zoom Workplace Apps", "vendor": "Zoom Communications, Inc", "versions": [{"status": "affected", "version": "See references"}]}], "datePublic": "2024-09-10T12:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Incorrect user management in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.<br><br>"}], "value": "Incorrect user management in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-286", "description": "CWE-286 Incorrect User Management", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "shortName": "Zoom", "dateUpdated": "2025-02-25T19:38:02.925Z"}, "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/zsb-24037/"}], "source": {"discovery": "UNKNOWN"}, "title": "Zoom Workplace Apps - Incorrect User Management", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-26T16:55:06.643915Z", "id": "CVE-2024-45425", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-26T16:57:20.637Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-45425", "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "state": "PUBLISHED", "assignerShortName": "Zoom", "dateReserved": "2024-08-28T21:50:25.333Z", "datePublished": "2025-02-25T19:38:02.925Z", "dateUpdated": "2025-02-26T16:57:20.637Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows", "MacOS", "Linux", "iOS", "Android"], "product": "Zoom Workplace Apps", "vendor": "Zoom Communications, Inc", "versions": [{"status": "affected", "version": "See references"}]}], "datePublic": "2024-09-10T12:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Incorrect user management in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.<br><br>"}], "value": "Incorrect user management in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-286", "description": "CWE-286 Incorrect User Management", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "shortName": "Zoom", "dateUpdated": "2025-02-25T19:38:02.925Z"}, "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/zsb-24037/"}], "source": {"discovery": "UNKNOWN"}, "title": "Zoom Workplace Apps - Incorrect User Management", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-45425", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-26T16:55:06.643915Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-26T16:55:44.933Z"}}]}}