« Volver al listado

CVE-2023-49647

Estado: ModificadaAlta (7.8)—

Improper access control in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows before version 5.16.10 may allow an authenticated user to conduct an escalation of privilege via local access.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (4)

Zoom — Meeting Software Development KITZoom — Video Software Development KITZoom — Virtual Desktop InfrastructureZoom — Zoom

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-49647",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-49647",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-08T15:47:19.131957Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@zoom.us",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@zoom.us",
      "affectedData": [
        {
          "vendor": "Zoom Video Communications, Inc.",
          "product": "Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows before version 5.16.10",
          "versions": [
            {
              "status": "affected",
              "version": "before 5.16.0"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-01-12T22:15:45.130",
  "references": [
    {
      "url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-24001/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@zoom.us"
    },
    {
      "url": "https://www.zoom.com/en/trust/security-bulletin/ZSB-24001/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@zoom.us",
      "description": [
        {
          "lang": "en",
          "value": "CWE-266"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper access control in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows before version 5.16.10 may allow an authenticated user to conduct an escalation of privilege via local access."
    },
    {
      "lang": "es",
      "value": "Un control de acceso inadecuado en Zoom Desktop Client para Windows, Zoom VDI Client para Windows y Zoom SDK para Windows anteriores a la versión 5.16.10 puede permitir que un usuario autenticado realice una escalada de privilegios a través del acceso local."
    }
  ],
  "lastModified": "2026-06-17T06:36:16.230",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zoom:meeting_software_development_kit:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6283C30D-420E-4A6F-B4C3-A67923467553",
              "versionEndExcluding": "5.16.10"
            },
            {
              "criteria": "cpe:2.3:a:zoom:video_software_development_kit:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ACB8BA0C-2FE3-4AB2-8C43-1035A95408E1",
              "versionEndExcluding": "5.16.10"
            },
            {
              "criteria": "cpe:2.3:a:zoom:zoom:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EE4453C1-144A-4101-935E-966676895835",
              "versionEndExcluding": "5.16.10"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zoom:virtual_desktop_infrastructure:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D33A3D73-DB80-4376-A9EE-2905A4B0B4B7",
              "versionEndExcluding": "5.14.14"
            },
            {
              "criteria": "cpe:2.3:a:zoom:virtual_desktop_infrastructure:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "33411E35-8D01-42E4-85D6-0FE2C416E697",
              "versionEndExcluding": "5.15.12",
              "versionStartIncluding": "5.15.0"
            },
            {
              "criteria": "cpe:2.3:a:zoom:virtual_desktop_infrastructure:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1865DF2E-65D2-4DEF-BFC5-5AC333AFF759",
              "versionEndExcluding": "5.16.10",
              "versionStartIncluding": "5.16.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "security@zoom.us"
}