CVE-2022-36930

Zoom Rooms for Windows installers before version 5.13.0 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain to escalate their privileges to the SYSTEM user.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://explore.zoom.us/en/trust/security/security-bulletin/	Vendor Advisory
https://explore.zoom.us/en/trust/security/security-bulletin/	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:zoom:rooms:*:*:*:*:*:windows:*:*

History

21 Nov 2024, 07:14

Type	Values Removed	Values Added
References	~~() https://explore.zoom.us/en/trust/security/security-bulletin/ - Vendor Advisory~~	() https://explore.zoom.us/en/trust/security/security-bulletin/ - Vendor Advisory
Summary		(es) Los instaladores de Zoom Rooms para Windows anteriores a la versión 5.13.0 contienen una vulnerabilidad de escalada de privilegios local. Un usuario local con pocos privilegios podría aprovechar esta vulnerabilidad en una cadena de ataque para escalar sus privilegios al usuario SYSTEM.
CVSS	v2 : ~~unknown~~ v3 : ~~7.8~~	v2 : unknown v3 : 8.8

Information

Published : 2023-01-09 19:15

Updated : 2024-11-21 07:14

NVD link : CVE-2022-36930

Mitre link : CVE-2022-36930

CVE.ORG link : CVE-2022-36930

JSON object : View

Products Affected

zoom

rooms

CWE

CWE-427

Uncontrolled Search Path Element

NVD-CWE-noinfo

{"id": "CVE-2022-36930", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security@zoom.us", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2023-01-09T19:15:11.660", "references": [{"url": "https://explore.zoom.us/en/trust/security/security-bulletin/", "tags": ["Vendor Advisory"], "source": "security@zoom.us"}, {"url": "https://explore.zoom.us/en/trust/security/security-bulletin/", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security@zoom.us", "description": [{"lang": "en", "value": "CWE-427"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Zoom Rooms for Windows installers before version 5.13.0 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerability in an attack chain to escalate their privileges to the SYSTEM user."}, {"lang": "es", "value": "Los instaladores de Zoom Rooms para Windows anteriores a la versi\u00f3n 5.13.0 contienen una vulnerabilidad de escalada de privilegios local. Un usuario local con pocos privilegios podr\u00eda aprovechar esta vulnerabilidad en una cadena de ataque para escalar sus privilegios al usuario SYSTEM."}], "lastModified": "2024-11-21T07:14:06.597", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:zoom:rooms:*:*:*:*:*:windows:*:*", "vulnerable": true, "matchCriteriaId": "11698115-1441-424C-976A-D1E8A42827B1", "versionEndExcluding": "5.13.0"}], "operator": "OR"}]}], "sourceIdentifier": "security@zoom.us"}