Vulnerability · Published Apr 9, 2021 · Assigned by mitre
CVE-2021-30480
High 8.5
In plain English
A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.2% (higher than 94% of all known vulnerabilities).
Severity (CVSS 3.1)8.5High
Exploit odds (30 days)7.2%top 5.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization, or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat software, which is different from the chat feature of the Zoom Meetings and Zoom Video Webinars software.
Affected products (as reported)
References
- https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/04/zoom-zero-day-discovery-makes-calls-safer-hackers-200000-richer/ x_refsource_MISC
- https://twitter.com/thezdi/status/1379855435730149378 x_refsource_MISC
- https://twitter.com/thezdi/status/1379859851061395459 x_refsource_MISC
- https://zoom.us/feature/messaging x_refsource_MISC
- https://www.securityweek.com/200000-awarded-zero-click-zoom-exploit-pwn2own x_refsource_MISC
- https://www.zdnet.com/article/critical-zoom-vulnerability-triggers-remote-code-execution-without-user-input/ x_refsource_MISC
- https://www.zerodayinitiative.com/advisories/ZDI-21-971/ x_refsource_MISC
- https://explore.zoom.us/en/trust/security/security-bulletin/ x_refsource_MISC
- https://sector7.computest.nl/post/2021-08-zoom/ x_refsource_MISC