Skip to main content

Meeting Software Development Kit CVE-2023-43586

HIGH
Untrusted Search Path (CWE-426)
2023-12-13 security@zoom.us
Privilege Escalation Path Traversal Microsoft Meeting Software Development Kit Video Software Development Kit Virtual Desktop Infrastructure Zoom
8.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Dec 13, 2023 - 23:15 nvd
HIGH 8.8

DescriptionNVD

Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to conduct an escalation of privilege via network access.

AnalysisAI

Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to conduct an escalation of privilege via network access. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-426. Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to conduct an escalation of privilege via network access. Affected products include: Zoom Meeting Software Development Kit, Zoom Video Software Development Kit, Zoom Virtual Desktop Infrastructure, Zoom.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Meeting Software Development Kit

View all
CVE-2024-24691 CRITICAL
9.8 Feb 14

Improper input validation in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Wind
CVE-2025-49457 CRITICAL
9.6 Aug 12

Untrusted search path in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an escalation of

CVE-2023-49647 HIGH
8.8 Jan 12

Improper access control in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows befor
CVE-2024-45421 HIGH
8.5 Feb 25

Buffer overflow in some Zoom Apps may allow an authenticated user to conduct an escalation of privilege via network acce
CVE-2023-39214 HIGH
8.1 Aug 08

Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial

CVE-2024-24697 HIGH
7.8 Feb 14

Untrusted search path in some Zoom 32 bit Windows clients may allow an authenticated user to conduct an escalation of pr
CVE-2024-45422 HIGH
7.5 Nov 19

Improper input validation in some Zoom Apps before version 6.2.0 may allow an unauthenticated user to conduct a denial o
CVE-2024-45419 HIGH
7.5 Nov 19

Improper input validation in some Zoom Apps may allow an unauthenticated user to conduct a disclosure of information via
CVE-2024-27241 HIGH
7.5 Jul 15

Improper input validation in some Zoom Apps and SDKs may allow an authenticated user to conduct a denial of service via

CVE-2023-39217 HIGH
7.5 Aug 08

Improper input validation in Zoom SDK’s before 5.14.10 may allow an unauthenticated user to enable a denial of service v
CVE-2023-36533 HIGH
7.5 Aug 08

Uncontrolled resource consumption in Zoom SDKs before 5.14.7 may allow an unauthenticated user to enable a denial of ser
CVE-2024-39819 HIGH
7.3 Jul 15

Integrity check in the installer for some Zoom Workplace Apps and SDKs for Windows may allow an authenticated user to co

Same weakness CWE-426 – Untrusted Search Path

View all
CVE-2015-0096 CRITICAL POC
9.3
CVE-2012-1854 HIGH POC
7.8
CVE-2016-5330 HIGH POC
7.8
CVE-2019-11660 HIGH POC
7.8
CVE-2017-12414 CRITICAL POC
9.8
CVE-2025-26155 CRITICAL POC
9.8
CVE-2023-30330 CRITICAL POC
9.8
CVE-2023-26036 CRITICAL POC
9.8

Same technique Privilege Escalation

View all
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2017-5689 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2016-10372 CRITICAL POC
9.8
CVE-2014-9583 CRITICAL POC
10.0
CVE-2012-0297 CRITICAL POC
10.0

Share

CVE-2023-43586 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy