CVE-2024-45424
Published: 25 February 2025
Description
Business logic error in some Zoom Workplace Apps may allow an unauthenticated user to conduct a disclosure of information via network access.
Security Summary
CVE-2024-45424 is a business logic error, mapped to CWE-840, affecting some Zoom Workplace Apps. Published on 2025-02-25, the vulnerability enables an unauthenticated user to conduct a disclosure of information via network access. It carries a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), indicating medium severity with low confidentiality impact and no impact on integrity or availability.
An unauthenticated attacker with network access to a vulnerable Zoom Workplace App can exploit this issue with low complexity and no requirement for user interaction or privileges. Exploitation leads to partial disclosure of sensitive information, as the scope remains unchanged.
Zoom has issued security bulletin ZSB-24036, available at https://www.zoom.com/en/trust/security-bulletin/zsb-24036/, which provides further details on the vulnerability. Security practitioners should consult this advisory for recommended mitigations and patching guidance.
Details
- CWE(s)