Medium severity · published Jul 15, 2024
CVE-2024-39826
Zoom Workplace Apps and SDKs - Path traversal
6.8
CVSS
0.4%
EPSS
No
On KEV
Description
Race condition in Team Chat for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct information disclosure via network access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZW
Zoom Workplace Apps and SDKs · Zoom Communications, Inc
see references · source: vendor
MS
Meeting Software Development Kit · Zoom
before 6.0.0 · source: NVD
WD
Workplace Desktop · Zoom
before 6.0.0 · source: NVD
WV
Workplace Virtual Desktop Infrastructure · Zoom
before 5.17.13 · source: NVD
Affected product
ZW
Zoom Workplace Apps and SDKs
Zoom Communications, Inc
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-39826
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-39826
Vendor Advisory
https://www.zoom.com/en/trust/security-bulletin/zsb-24023
More from Zoom Workplace Apps and SDKs
6.5
CVE-2024-27239
Zoom Workplace Apps and SDKs - Divide By Zero
6.5
CVE-2024-27246
Zoom Workplace Apps and SDKs - Use After Free
6.5
CVE-2024-27245
Zoom Workplace Apps and SDKs - Buffer Overflow
6.5
CVE-2024-39818
Zoom Workplace Apps and SDKs - Protection Mechanism Failure