CVE-2024-24697: Zoom Clients - Untrusted Search Path

Q: What is the severity of CVE-2024-24697?

CVE-2024-24697 has been classified as a moderate severity vulnerability due to its potential for privilege escalation.

Q: How do I fix CVE-2024-24697?

To remediate CVE-2024-24697, update your Zoom client to the latest version beyond 5.17.0 for relevant products.

Q: What types of Zoom products are affected by CVE-2024-24697?

CVE-2024-24697 affects various Zoom products, including Zoom Desktop Client, Zoom Client for Meetings, and Zoom Meeting SDK for versions below specified thresholds.

Q: Can a non-authenticated user exploit CVE-2024-24697?

No, CVE-2024-24697 requires an authenticated user to exploit the vulnerability.

Q: What attack vector is associated with CVE-2024-24697?

CVE-2024-24697 involves an untrusted search path that may allow local access to escalate privileges.

Published Feb 13, 2024

Updated

Untrusted search path in some Zoom 32 bit Windows clients may allow an authenticated user to conduct an escalation of privilege via local access.

Affected Software

15 affected components

Zoom Meeting Software Development Kit Windows<5.17.0

Zoom Rooms<5.17.0

Zoom Vdi Windows Meeting Clients Windows<5.15.5

Zoom Vdi Windows Meeting Clients Windows>5.15.5<5.16.2

Zoom Vdi Windows Meeting Clients Windows>5.16.2<5.17.5

Zoom Zoom Windows<5.17.0

Zoom Zoom Desktop Client=before version 5.16.5

Zoom Zoom VDI client=before version 5.16.10 (excluding 5.14.14 and 5.15.12)

Zoom Zoom Rooms Client=before version 5.17.0

Zoom Zoom Meeting SDK=before version 5.16.5

Zoom Zoom desktop apps

Zoom Zoom mobile apps

Zoom Zoom VDI client

Zoom Zoom Rooms Client

Zoom Zoom Meeting SDKs

Event History

Feb 13, 2024

CVE Published

via MITRE·11:53 PM

Data Sourced

via MITRE·11:53 PM

DescriptionSeverityWeakness

Feb 14, 2024

Data Sourced

via NVD·12:15 AM

DescriptionSeverityWeaknessAffected Software

Feb 15, 2024

News Published

via The Register·03:30 PM

News Published

via The Register·03:33 PM

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2024-24697?

CVE-2024-24697 has been classified as a moderate severity vulnerability due to its potential for privilege escalation.

How do I fix CVE-2024-24697?

To remediate CVE-2024-24697, update your Zoom client to the latest version beyond 5.17.0 for relevant products.

What types of Zoom products are affected by CVE-2024-24697?

CVE-2024-24697 affects various Zoom products, including Zoom Desktop Client, Zoom Client for Meetings, and Zoom Meeting SDK for versions below specified thresholds.

Can a non-authenticated user exploit CVE-2024-24697?