CVE-2024-27244 - Vulnerability Details - OpenCVE

Insufficient verification of data authenticity in the installer for Zoom Workplace VDI App for Windows may allow an authenticated user to conduct an escalation of privilege via local access.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Zoom	Vdi Windows Meeting Client

No data.

No data.

References

Link	Providers
https://www.zoom.com/en/trust/security-bulletin/zsb-24015/

History

Fri, 20 Sep 2024 15:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-345

Fri, 20 Sep 2024 15:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Zoom Zoom vdi Windows Meeting Client
CPEs		cpe:2.3:a:zoom:vdi_windows_meeting_client::::::::
Vendors & Products		Zoom Zoom vdi Windows Meeting Client
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 20 Sep 2024 14:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-347

MITRE

Status: PUBLISHED

Assigner: Zoom

Published: 2024-05-15T20:46:37.922Z

Updated: 2024-09-20T14:31:59.382Z

Reserved: 2024-02-21T21:15:32.633Z

Link: CVE-2024-27244

Vulnrichment

Updated: 2024-08-02T00:27:59.863Z

NVD

Status : Awaiting Analysis

Published: 2024-05-15T21:15:08.220

Modified: 2024-11-21T09:04:11.443

Link: CVE-2024-27244

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-27244", "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "state": "PUBLISHED", "assignerShortName": "Zoom", "dateReserved": "2024-02-21T21:15:32.633Z", "datePublished": "2024-05-15T20:46:37.922Z", "dateUpdated": "2024-09-20T14:31:59.382Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Windows"], "product": "Zoom Workplace VDI App for Windows", "vendor": "Zoom Video Communications, Inc.", "versions": [{"status": "affected", "version": "< 5.17.10"}]}], "datePublic": "2024-05-14T12:00:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(247, 247, 248);\">Insufficient verification of data authenticity in the installer for Zoom Workplace VDI App for Windows may allow an authenticated user to conduct an escalation of privilege via local access.</span><br>"}], "value": "Insufficient verification of data authenticity in the installer for Zoom Workplace VDI App for Windows may allow an authenticated user to conduct an escalation of privilege via local access."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-347", "description": "CWE-347 Improper Verification of Cryptographic Signature", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "shortName": "Zoom", "dateUpdated": "2024-09-20T14:31:59.382Z"}, "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/zsb-24015/"}], "source": {"discovery": "UNKNOWN"}, "title": "Zoom Workplace VDI App for Windows - Insufficient Verification of Data Authenticity", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "zoom", "product": "vdi_windows_meeting_client", "cpes": ["cpe:2.3:a:zoom:vdi_windows_meeting_client:*:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "0", "status": "affected", "lessThan": "5.17.10", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-05-16T17:29:39.718000Z", "id": "CVE-2024-27244", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-06T15:21:25.196Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:27:59.863Z"}, "title": "CVE Program Container", "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/zsb-24015/", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/zsb-24015/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T00:27:59.863Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-27244", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-05-16T17:29:39.718000Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:zoom:vdi_windows_meeting_client:*:*:*:*:*:*:*:*"], "vendor": "zoom", "product": "vdi_windows_meeting_client", "versions": [{"status": "affected", "version": "0", "lessThan": "5.17.10", "versionType": "custom"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-16T17:32:26.913Z"}}], "cna": {"title": "Zoom Workplace VDI App for Windows - Insufficient Verification of Data Authenticity", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Zoom Video Communications, Inc.", "product": "Zoom Workplace VDI App for Windows", "versions": [{"status": "affected", "version": "< 5.17.10"}], "platforms": ["Windows"], "defaultStatus": "unaffected"}], "datePublic": "2024-05-14T12:00:00.000Z", "references": [{"url": "https://www.zoom.com/en/trust/security-bulletin/zsb-24015/"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Insufficient verification of data authenticity in the installer for Zoom Workplace VDI App for Windows may allow an authenticated user to conduct an escalation of privilege via local access.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(247, 247, 248);\">Insufficient verification of data authenticity in the installer for Zoom Workplace VDI App for Windows may allow an authenticated user to conduct an escalation of privilege via local access.</span><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347 Improper Verification of Cryptographic Signature"}]}], "providerMetadata": {"orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "shortName": "Zoom", "dateUpdated": "2024-09-20T14:31:59.382Z"}}}, "cveMetadata": {"cveId": "CVE-2024-27244", "state": "PUBLISHED", "dateUpdated": "2024-09-20T14:31:59.382Z", "dateReserved": "2024-02-21T21:15:32.633Z", "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351", "datePublished": "2024-05-15T20:46:37.922Z", "assignerShortName": "Zoom"}, "dataVersion": "5.1"}