CVE-2021-30480
First published: Fri Apr 09 2021(Updated: )
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization, or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat software, which is different from the chat feature of the Zoom Meetings and Zoom Video Webinars software.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zoom Chat | <=2021-04-09 | |
| Apple macOS | ||
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/04/zoom-zero-day-discovery-makes-calls-safer-hackers-200000-richer/
- https://explore.zoom.us/en/trust/security/security-bulletin/
- https://sector7.computest.nl/post/2021-08-zoom/
- https://twitter.com/thezdi/status/1379855435730149378
- https://twitter.com/thezdi/status/1379859851061395459
- https://www.securityweek.com/200000-awarded-zero-click-zoom-exploit-pwn2own
- https://www.zdnet.com/article/critical-zoom-vulnerability-triggers-remote-code-execution-without-user-input/
- https://www.zerodayinitiative.com/advisories/ZDI-21-971/
- https://zoom.us/feature/messaging
- collector/nvd-index
- agent/severity
- agent/references
- agent/author
- agent/type
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/zoom
- canonical/zoom chat
- version/zoom chat/2021-04-09
- vendor/apple
- canonical/apple macos
- vendor/microsoft
- canonical/microsoft windows