« Volver al listado

CVE-2024-27244

Estado: AnalizadaAlta (7.8)—

Insufficient verification of data authenticity in the installer for Zoom Workplace VDI App for Windows may allow an authenticated user to conduct an escalation of privilege via local access.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Zoom — Workplace Virtual Desktop Infrastructure

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-27244",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-27244",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-05-16T17:29:39.718000Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@zoom.us",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@zoom.us",
      "affectedData": [
        {
          "vendor": "Zoom Video Communications, Inc.",
          "product": "Zoom Workplace VDI App for Windows",
          "versions": [
            {
              "status": "affected",
              "version": "< 5.17.10"
            }
          ],
          "platforms": [
            "Windows"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:zoom:vdi_windows_meeting_client:*:*:*:*:*:*:*:*"
          ],
          "vendor": "zoom",
          "product": "vdi_windows_meeting_client",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "5.17.10",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-05-15T21:15:08.220",
  "references": [
    {
      "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-24015/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@zoom.us"
    },
    {
      "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-24015/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security@zoom.us",
      "description": [
        {
          "lang": "en",
          "value": "CWE-347"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insufficient verification of data authenticity in the installer for Zoom Workplace  VDI App for Windows may allow an authenticated user to conduct an escalation of privilege via local access."
    },
    {
      "lang": "es",
      "value": "Una verificación insuficiente de la autenticidad de los datos en el instalador de la aplicación Zoom Workplace VDI para Windows puede permitir que un usuario autenticado realice una escalada de privilegios a través del acceso local."
    }
  ],
  "lastModified": "2026-06-17T07:19:31.007",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zoom:workplace_virtual_desktop_infrastructure:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "42A0AA83-66B4-42FC-BBFA-EF365EB036CC",
              "versionEndExcluding": "5.15.0"
            },
            {
              "criteria": "cpe:2.3:a:zoom:workplace_virtual_desktop_infrastructure:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9960288B-0929-40DF-A435-3D0897E688BC",
              "versionEndExcluding": "5.17.10",
              "versionStartIncluding": "5.16.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@zoom.us"
}