Vulnerability Report

CVE-2019-13567

RCE

Title: Zoom RCE

RCE

Proof Of Concept

No public PoC currently indexed for CVE-2019-13567.

CWE Category CWE-78
Published Date Jul 12, 2019
Modified Date Nov 21, 2024
Exploit Status Not Found
Score 8.8 CVSS v3.1
Exploit Probability (EPSS)
3.80%

Vulnerability Summary

CVE-2019-13567: The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon (aka the hidden web server) is running, but the Zoom Client is not installed or can't be opened, an attacker can remotely execute code with a maliciously crafted launch URL. NOTE: ZoomOpener is removed by the Apple Malware Removal Tool (MRT) if this tool is enabled and has the 2019-07-10 MRTConfigData.

Impacted Vendors

Z
zoom 1
M
mattermost 1

Reference Links

https://gist.github.com/wbowling/13f9f90365c171806b9ffba2c841026b https://support.zoom.us/hc/en-us/articles/201361963-New-Updates-for-Mac-OS https://twitter.com/JLLeitschuh/status/1149420685405708295 https://twitter.com/JLLeitschuh/status/1149422543658520578 https://twitter.com/riskybusiness/status/1149125147019767814 https://twitter.com/wcbowling/status/1149457231504498689 https://twitter.com/wcbowling/status/1166998107667619841 https://gist.github.com/wbowling/13f9f90365c171806b9ffba2c841026b https://support.zoom.us/hc/en-us/articles/201361963-New-Updates-for-Mac-OS https://twitter.com/JLLeitschuh/status/1149420685405708295 https://twitter.com/JLLeitschuh/status/1149422543658520578 https://twitter.com/riskybusiness/status/1149125147019767814 https://twitter.com/wcbowling/status/1149457231504498689 https://twitter.com/wcbowling/status/1166998107667619841
CVSS v3.1
Source Entity [email protected]
Severity HIGH
8.8
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
REQUIRED
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v2.0
Source Entity [email protected]
Severity MEDIUM
6.8
Access Vector
N/A
Authentication
N/A
RAW VECTOR AV:N/AC:M/Au:N/C:P/I:P/A:P

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2019-13567 Exploits & PoCs (Proof Of Concept)

No public PoCs found in our database for this CVE.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector NETWORK
Complexity LOW
Privileges N/A
Interaction REQUIRED
CVSS Vector String CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Stack

No specific products linked.