CVE-2023-39212 : Untrusted search path in Zoom Rooms for Windows before version 5.15.5 may allow an authenticated user to enable a denial

Untrusted search path in Zoom Rooms for Windows before version 5.15.5 may allow an authenticated user to enable a denial of service via local access.

Published 2023-08-08 22:15:11

Updated 2023-08-15 15:24:11

View at NVD, CVE.org

Vulnerability category: File inclusionDenial of service

Products affected by CVE-2023-39212

Zoom » Rooms » For Windows
Versions before (<) 5.15.5
cpe:2.3:a:zoom:rooms:*:*:*:*:*:windows:*:*
Matching versions

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 7 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
7.9	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H	1.5	5.8	Zoom Video Communications, Inc.
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Changed Confidentiality: None Integrity: High Availability: High

CWE-144 Improper Neutralization of Line Delimiters

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as line delimiters when they are sent to a downstream component.

Assigned by: security@zoom.us (Secondary)
CWE-426 Untrusted Search Path

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

Assigned by: nvd@nist.gov (Primary)

Jump to