CVE-2024-39826
15.07.2024, 18:15
Path traversal in Team Chat for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to conduct information disclosure via network access.
| Vendor | Product | Version |
|---|---|---|
| zoom | meeting_software_development_kit | 𝑥 < 6.0.0 |
| zoom | workplace_desktop | 𝑥 < 6.0.0 |
| zoom | workplace_virtual_desktop_infrastructure | 𝑥 < 5.17.13 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-367 - Time-of-check Time-of-use (TOCTOU) Race ConditionThe software checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the software to perform invalid actions when the resource is in an unexpected state.
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.