CVE-2024-45426 - Vulnerability Details

Vendors	Products
Zoom	Meeting Software Development Kit Rooms Rooms Controller Workplace Workplace Desktop Workplace Virtual Desktop Infrastructure

Link	Providers
https://www.zoom.com/en/trust/security-bulletin/zsb-24038/

Type	Values Removed	Values Added
First Time appeared		Zoom Zoom meeting Software Development Kit Zoom rooms Zoom rooms Controller Zoom workplace Zoom workplace Desktop Zoom workplace Virtual Desktop Infrastructure
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:a:zoom:meeting_software_development_kit::::::iphone_os::* cpe:2.3:a:zoom:meeting_software_development_kit::::::linux::* cpe:2.3:a:zoom:meeting_software_development_kit::::::windows::* cpe:2.3:a:zoom:rooms::::::ipad_os::* cpe:2.3:a:zoom:rooms::::::windows::* cpe:2.3:a:zoom:rooms_controller::::::linux::* cpe:2.3:a:zoom:rooms_controller::::::macos::* cpe:2.3:a:zoom:rooms_controller::::::windows::* cpe:2.3:a:zoom:workplace::::::iphone_os::* cpe:2.3:a:zoom:workplace_desktop::::::linux::* cpe:2.3:a:zoom:workplace_desktop::::::windows::* cpe:2.3:a:zoom:workplace_virtual_desktop_infrastructure::::::windows::*
Vendors & Products		Zoom Zoom meeting Software Development Kit Zoom rooms Zoom rooms Controller Zoom workplace Zoom workplace Desktop Zoom workplace Virtual Desktop Infrastructure

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.
Title		Zoom Workplace Apps - Incorrect Ownership Assignment
Weaknesses		CWE-708
References		https://www.zoom.com/en/trust/security-bulletin/zsb-24038/
Metrics		cvssV3_1 `{'score': 4.9, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-45426", "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "state": "PUBLISHED", "assignerShortName": "Zoom", "dateReserved": "2024-08-28T21:50:25.333Z", "datePublished": "2025-02-25T19:39:48.596Z", "dateUpdated": "2025-02-26T16:49:25.061Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows", "MacOS", "Linux", "iOS", "Android"], "product": "Zoom Workplace Apps", "vendor": "Zoom Communications, Inc", "versions": [{"status": "affected", "version": "See references"}]}], "datePublic": "2024-10-08T12:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.<br>"}], "value": "Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-708", "description": "CWE-708: Incorrect Ownership Assignment", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "shortName": "Zoom", "dateUpdated": "2025-02-25T19:39:48.596Z"}, "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/zsb-24038/"}], "source": {"discovery": "UNKNOWN"}, "title": "Zoom Workplace Apps - Incorrect Ownership Assignment", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-26T16:49:09.744526Z", "id": "CVE-2024-45426", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-26T16:49:25.061Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-45426 (string)

assignerOrgId : 99b9af0d-a833-4a5d-9e2f-8b1324f35351 (string)

state : PUBLISHED (string)

assignerShortName : Zoom (string)

dateReserved : 2024-08-28T21:50:25.333Z (string)

datePublished : 2025-02-25T19:39:48.596Z (string)

dateUpdated : 2025-02-26T16:49:25.061Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

platforms : [ »

0 : Windows (string)

1 : MacOS (string)

2 : Linux (string)

3 : iOS (string)

4 : Android (string)

]

product : Zoom Workplace Apps (string)

vendor : Zoom Communications, Inc (string)

versions : [ »

0 : { »

status : affected (string)

version : See references (string)

}

]

}

]

datePublic : 2024-10-08T12:00:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.<br> (string)

}

]

value : Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.9 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-708 (string)

description : CWE-708: Incorrect Ownership Assignment (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 99b9af0d-a833-4a5d-9e2f-8b1324f35351 (string)

shortName : Zoom (string)

dateUpdated : 2025-02-25T19:39:48.596Z (string)

}

references : [ »

0 : { »

url : https://www.zoom.com/en/trust/security-bulletin/zsb-24038/ (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : Zoom Workplace Apps - Incorrect Ownership Assignment (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-02-26T16:49:09.744526Z (string)

id : CVE-2024-45426 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-02-26T16:49:25.061Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-45426", "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "state": "PUBLISHED", "assignerShortName": "Zoom", "dateReserved": "2024-08-28T21:50:25.333Z", "datePublished": "2025-02-25T19:39:48.596Z", "dateUpdated": "2025-02-26T16:49:25.061Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows", "MacOS", "Linux", "iOS", "Android"], "product": "Zoom Workplace Apps", "vendor": "Zoom Communications, Inc", "versions": [{"status": "affected", "version": "See references"}]}], "datePublic": "2024-10-08T12:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.<br>"}], "value": "Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-708", "description": "CWE-708: Incorrect Ownership Assignment", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "shortName": "Zoom", "dateUpdated": "2025-02-25T19:39:48.596Z"}, "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/zsb-24038/"}], "source": {"discovery": "UNKNOWN"}, "title": "Zoom Workplace Apps - Incorrect Ownership Assignment", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-45426", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-02-26T16:49:09.744526Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-26T16:49:19.281Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-45426 (string)

assignerOrgId : 99b9af0d-a833-4a5d-9e2f-8b1324f35351 (string)

state : PUBLISHED (string)

assignerShortName : Zoom (string)

dateReserved : 2024-08-28T21:50:25.333Z (string)

datePublished : 2025-02-25T19:39:48.596Z (string)

dateUpdated : 2025-02-26T16:49:25.061Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

platforms : [ »

0 : Windows (string)

1 : MacOS (string)

2 : Linux (string)

3 : iOS (string)

4 : Android (string)

]

product : Zoom Workplace Apps (string)

vendor : Zoom Communications, Inc (string)

versions : [ »

0 : { »

status : affected (string)

version : See references (string)

}

]

}

]

datePublic : 2024-10-08T12:00:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access.<br> (string)

}

]

value : Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access. (string)

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.9 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-708 (string)

description : CWE-708: Incorrect Ownership Assignment (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 99b9af0d-a833-4a5d-9e2f-8b1324f35351 (string)

shortName : Zoom (string)

dateUpdated : 2025-02-25T19:39:48.596Z (string)

}

references : [ »

0 : { »

url : https://www.zoom.com/en/trust/security-bulletin/zsb-24038/ (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : Zoom Workplace Apps - Incorrect Ownership Assignment (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-45426 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-02-26T16:49:09.744526Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-02-26T16:49:19.281Z (string)

}

]

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:zoom:meeting_software_development_kit:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "6E039542-3E10-4565-9543-71F50F06A933", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:meeting_software_development_kit:*:*:*:*:*:linux:*:*", "matchCriteriaId": "BAB2DBC4-95E2-47D1-A343-12A09D3E9D38", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:meeting_software_development_kit:*:*:*:*:*:windows:*:*", "matchCriteriaId": "F82C8A03-C83C-4404-84C1-D9D4836B9982", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:rooms:*:*:*:*:*:ipad_os:*:*", "matchCriteriaId": "23B5BD12-AA42-47A8-9BC7-5F59B48160C9", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:rooms:*:*:*:*:*:windows:*:*", "matchCriteriaId": "242D5F39-22FC-4304-8F36-3A0A23BDCC6E", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:rooms_controller:*:*:*:*:*:linux:*:*", "matchCriteriaId": "A1D900AF-A23B-4D1C-BDE3-CE99DFFBDEBB", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:rooms_controller:*:*:*:*:*:macos:*:*", "matchCriteriaId": "B497C5C3-921E-462B-91A3-58DA2F669236", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:rooms_controller:*:*:*:*:*:windows:*:*", "matchCriteriaId": "D40263F3-4A0E-418E-AF91-8AD20A957D9F", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:workplace:*:*:*:*:*:iphone_os:*:*", "matchCriteriaId": "8FE458E6-5ACB-428D-A339-D826E5EDDAD1", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:workplace_desktop:*:*:*:*:*:linux:*:*", "matchCriteriaId": "65DD163F-BB0E-4BE3-9545-F379774F3AE4", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:workplace_desktop:*:*:*:*:*:windows:*:*", "matchCriteriaId": "3A34FEBC-6E74-4F03-BFA7-FD37226097F1", "versionEndExcluding": "6.1.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:zoom:workplace_virtual_desktop_infrastructure:*:*:*:*:*:windows:*:*", "matchCriteriaId": "22369469-1A7D-4130-B5AE-E76F31405B94", "versionEndExcluding": "6.1.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Incorrect ownership assignment in some Zoom Workplace Apps may allow a privileged user to conduct an information disclosure via network access."}, {"lang": "es", "value": "La asignaci\u00f3n de propiedad incorrecta en algunas aplicaciones de Zoom Workplace puede permitir que un usuario privilegiado realice una divulgaci\u00f3n de informaci\u00f3n a trav\u00e9s del acceso a la red."}], "id": "CVE-2024-45426", "lastModified": "2025-03-04T20:42:55.570", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security@zoom.us", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2025-02-25T20:15:35.927", "references": [{"source": "security@zoom.us", "tags": ["Vendor Advisory"], "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-24038/"}], "sourceIdentifier": "security@zoom.us", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-708"}], "source": "security@zoom.us", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:zoom:meeting_software_development_kit:*:*:*:*:*:iphone_os:*:* (string)

matchCriteriaId : 6E039542-3E10-4565-9543-71F50F06A933 (string)