CVE-2021-30480

Опубликовано: 09 апр. 2021

Источник: nvd

CVSS3: 8.5

CVSS3: 8.8

CVSS2: 9

EPSS Средний

Описание

Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization, or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat software, which is different from the chat feature of the Zoom Meetings and Zoom Video Webinars software.

Ссылки

https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/04/zoom-zero-day-discovery-makes-calls-safer-hackers-200000-richer/
Third Party Advisory
https://explore.zoom.us/en/trust/security/security-bulletin/
Vendor Advisory
https://sector7.computest.nl/post/2021-08-zoom/
Exploit
Third Party Advisory
https://twitter.com/thezdi/status/1379855435730149378
Third Party Advisory
https://twitter.com/thezdi/status/1379859851061395459
Third Party Advisory
https://www.securityweek.com/200000-awarded-zero-click-zoom-exploit-pwn2own
Press/Media Coverage
Third Party Advisory
https://www.zdnet.com/article/critical-zoom-vulnerability-triggers-remote-code-execution-without-user-input/
Press/Media Coverage
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-971/
Third Party Advisory
VDB Entry
https://zoom.us/feature/messaging
Product
Vendor Advisory
https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/04/zoom-zero-day-discovery-makes-calls-safer-hackers-200000-richer/
Third Party Advisory
https://explore.zoom.us/en/trust/security/security-bulletin/
Vendor Advisory
https://sector7.computest.nl/post/2021-08-zoom/
Exploit
Third Party Advisory
https://twitter.com/thezdi/status/1379855435730149378
Third Party Advisory
https://twitter.com/thezdi/status/1379859851061395459
Third Party Advisory
https://www.securityweek.com/200000-awarded-zero-click-zoom-exploit-pwn2own
Press/Media Coverage
Third Party Advisory
https://www.zdnet.com/article/critical-zoom-vulnerability-triggers-remote-code-execution-without-user-input/
Press/Media Coverage
Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-971/
Third Party Advisory
VDB Entry
https://zoom.us/feature/messaging
Product
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:zoom:chat:*:*:*:*:*:*:*:*

Версия до 2021-04-09 (включая)

Одно из

cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*

EPSS

Процентиль: 93%

0.1036

Средний

8.5 High

CVSS3

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-r6hm-86cv-xhmq

CVSS3: 8.8

github

больше 3 лет назад

EPSS

Процентиль: 93%

0.1036

Средний

8.5 High

CVSS3

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

NVD-CWE-noinfo