Medium severity · published Aug 14, 2024
CVE-2024-42439
Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS - Untrusted Search Path
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
Untrusted search path in the installer for Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS before 6.1.0 may allow a privileged user to conduct an escalation of privilege via local access.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZW
Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS · Zoom Communications Inc.
before version 6.1.0 · source: vendor
MS
Meeting Software Development Kit · Zoom
before 6.1.0 · source: NVD
WD
Workplace Desktop · Zoom
before 6.1.0 · source: NVD, CISA
Affected product
ZW
Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS
Zoom Communications Inc.