{"id":"CVE-2023-39213","state":"PUBLISHED","title":"Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before 5.15.2 may allow an unauthenticated user to enable an escalation of privil","description":"Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before 5.15.2 may allow an unauthenticated user to enable an escalation of privilege via network access.","publishedAt":"2023-08-08T21:36:13.783Z","updatedAt":"2024-10-10T16:19:52.228Z","severity":{"score":9.6,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","source":"Zoom"},"assigner":"Zoom","products":["Zoom Video Communications, Inc. Zoom Desktop Client for Windows and Zoom VDI Client"],"affected":[{"vendor":"Zoom Video Communications, Inc.","product":"Zoom Desktop Client for Windows and Zoom VDI Client","defaultStatus":"unaffected","versions":[{"version":"before 5.15.2","status":"affected"}],"platforms":["Windows"]}],"references":["https://explore.zoom.us/en/trust/security/security-bulletin/"],"weaknesses":["CWE-176"],"ingestedAt":"2026-10-29T20:06:08.715Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/39xxx/CVE-2023-39213.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-39213","state":"PUBLISHED","datePublished":"2023-08-08T21:36:13.783Z","dateUpdated":"2024-10-10T16:19:52.228Z","assignerShortName":"Zoom","assignerOrgId":"99b9af0d-a833-4a5d-9e2f-8b1324f35351","dateReserved":"2023-07-25T18:38:00.938Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before 5.15.2 may allow an unauthenticated user to enable an escalation of privilege via network access."}],"affected":[{"vendor":"Zoom Video Communications, Inc.","product":"Zoom Desktop Client for Windows and Zoom VDI Client","defaultStatus":"unaffected","versions":[{"version":"before 5.15.2","status":"affected"}],"platforms":["Windows"]}],"references":[{"url":"https://explore.zoom.us/en/trust/security/security-bulletin/"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.6,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-176","description":"CWE-176: Improper Handling of Unicode Encoding","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"Zoom","orgId":"99b9af0d-a833-4a5d-9e2f-8b1324f35351","dateUpdated":"2024-09-27T19:05:47.094Z"},"datePublic":"2023-08-08T15:00:00.000Z","source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://explore.zoom.us/en/trust/security/security-bulletin/","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T18:02:06.849Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-10-10T16:19:43.040384Z","id":"CVE-2023-39213","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-10-10T16:19:52.228Z"}}]}}}