CVE-2021-30480
First published: Fri Apr 09 2021(Updated: )
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization, or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat software, which is different from the chat feature of the Zoom Meetings and Zoom Video Webinars software.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Zoom Chat | <=2021-04-09 | |
| Apple iOS and macOS | ||
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/04/zoom-zero-day-discovery-makes-calls-safer-hackers-200000-richer/
- https://explore.zoom.us/en/trust/security/security-bulletin/
- https://sector7.computest.nl/post/2021-08-zoom/
- https://twitter.com/thezdi/status/1379855435730149378
- https://twitter.com/thezdi/status/1379859851061395459
- https://www.securityweek.com/200000-awarded-zero-click-zoom-exploit-pwn2own
- https://www.zdnet.com/article/critical-zoom-vulnerability-triggers-remote-code-execution-without-user-input/
- https://www.zerodayinitiative.com/advisories/ZDI-21-971/
- https://zoom.us/feature/messaging
Frequently Asked Questions
What is the severity of CVE-2021-30480?
CVE-2021-30480 has a high severity level due to the potential for remote code execution without user interaction.
How do I fix CVE-2021-30480?
To mitigate CVE-2021-30480, ensure you update Zoom Chat to a version released after April 9, 2021.
Who is affected by CVE-2021-30480?
CVE-2021-30480 affects users of Zoom Chat up to the version released on April 9, 2021, on Windows and macOS.
What type of attack does CVE-2021-30480 enable?
CVE-2021-30480 enables remote authenticated attackers to execute arbitrary code within the affected Zoom Chat application.
Is CVE-2021-30480 a user-interaction vulnerability?
No, CVE-2021-30480 does not require user interaction for exploitation, making it particularly dangerous.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/severity
- agent/author
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/zoom
- canonical/zoom chat
- version/zoom chat/2021-04-09
- vendor/apple
- canonical/apple ios and macos
- vendor/microsoft
- canonical/microsoft windows