CVE-2018-15715

State: Published
Severity: Not scored
Published: Nov 30, 2018
Updated: Sep 16, 2024
Reserved: Aug 22, 2018

Description

Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116), and Linux (2.4.129780.0915 and below) are vulnerable to unauthorized message processing. A remote unauthenticated attacker can spoof UDP messages from a meeting attendee or Zoom server in order to invoke functionality in the target client. This allows the attacker to remove attendees from meetings, spoof messages from users, or hijack shared screens.

Scores

The record has no CVSS score.

Weaknesses

CWE-290 Authentication Bypass by Spoofing

Affected Products

Product	Versions
ZoomZoom	Zoom on Windows before version 4.1.34814.1119, Zoom on Mac OS before version 4.1.34801.1116, Zoom on Linux version 2.4.129780.0915 and below.Affected

References

https://www.tenable.com/security/research/tra-2018-40

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.