CVE-2018-15715

CRITICAL

Zoom < 4.1.34814.1119 (Windows), < 4.1.34801.1116 (Mac), <= 2.4.129780.0915 (Linux) - Unauthenticated Message Spoofing

Title source: llm
STIX 2.1

Description

Zoom clients on Windows (before version 4.1.34814.1119), Mac OS (before version 4.1.34801.1116), and Linux (2.4.129780.0915 and below) are vulnerable to unauthorized message processing. A remote unauthenticated attacker can spoof UDP messages from a meeting attendee or Zoom server in order to invoke functionality in the target client. This allows the attacker to remove attendees from meetings, spoof messages from users, or hijack shared screens.

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://www.tenable.com/security/research/tra-2018-40

Scores

CVSS v3 9.8
EPSS 0.0093
EPSS Percentile 76.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-290 CWE-20
Status published
Products (3)
zoom/zoom < 2.4.129780.0915
zoom/zoom < 4.1.34801.1116
zoom/zoom < 4.1.34814.1119
Published Nov 30, 2018
Tracked Since Feb 18, 2026