CVE-2021-30480

Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization, or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat software, which is different from the chat feature of the Zoom Meetings and Zoom Video Webinars software.

CVSS v3.0 8.8 HIGH
CVSS v2.0 9.0 HIGH

8.8^/10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

9.0^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:S/C:C/I:C/A:C

Exploitability : 8.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://www.zdnet.com/article/critical-zoom-vulnerability-triggers-remote-code-execution-without-user-input/	Press/Media Coverage Third Party Advisory
https://twitter.com/thezdi/status/1379859851061395459	Third Party Advisory
https://www.securityweek.com/200000-awarded-zero-click-zoom-exploit-pwn2own	Press/Media Coverage Third Party Advisory
https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/04/zoom-zero-day-discovery-makes-calls-safer-hackers-200000-richer/	Third Party Advisory
https://zoom.us/feature/messaging	Product Vendor Advisory
https://twitter.com/thezdi/status/1379855435730149378	Third Party Advisory
https://www.zerodayinitiative.com/advisories/ZDI-21-971/	Third Party Advisory VDB Entry
https://explore.zoom.us/en/trust/security/security-bulletin/	Vendor Advisory
https://sector7.computest.nl/post/2021-08-zoom/	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:zoom:chat:*:*:*:*:*:*:*:*

OR	cpe:2.3:o:apple:macos:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

Information

Published : 2021-04-09 16:15

Updated : 2021-09-21 10:46

NVD link : CVE-2021-30480

Mitre link : CVE-2021-30480

JSON object : View

CWE

NVD-CWE-noinfo

Products Affected

microsoft

windows

zoom

chat

apple

macos

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://www.zdnet.com/article/critical-zoom-vulnerability-triggers-remote-code-execution-without-user-input/", "name": "https://www.zdnet.com/article/critical-zoom-vulnerability-triggers-remote-code-execution-without-user-input/", "tags": ["Press/Media Coverage", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://twitter.com/thezdi/status/1379859851061395459", "name": "https://twitter.com/thezdi/status/1379859851061395459", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "https://www.securityweek.com/200000-awarded-zero-click-zoom-exploit-pwn2own", "name": "https://www.securityweek.com/200000-awarded-zero-click-zoom-exploit-pwn2own", "tags": ["Press/Media Coverage", "Third Party Advisory"], "refsource": "MISC"}, {"url": "https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/04/zoom-zero-day-discovery-makes-calls-safer-hackers-200000-richer/", "name": "https://blog.malwarebytes.com/exploits-and-vulnerabilities/2021/04/zoom-zero-day-discovery-makes-calls-safer-hackers-200000-richer/", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "https://zoom.us/feature/messaging", "name": "https://zoom.us/feature/messaging", "tags": ["Product", "Vendor Advisory"], "refsource": "MISC"}, {"url": "https://twitter.com/thezdi/status/1379855435730149378", "name": "https://twitter.com/thezdi/status/1379855435730149378", "tags": ["Third Party Advisory"], "refsource": "MISC"}, {"url": "https://www.zerodayinitiative.com/advisories/ZDI-21-971/", "name": "https://www.zerodayinitiative.com/advisories/ZDI-21-971/", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "MISC"}, {"url": "https://explore.zoom.us/en/trust/security/security-bulletin/", "name": "https://explore.zoom.us/en/trust/security/security-bulletin/", "tags": ["Vendor Advisory"], "refsource": "MISC"}, {"url": "https://sector7.computest.nl/post/2021-08-zoom/", "name": "https://sector7.computest.nl/post/2021-08-zoom/", "tags": ["Exploit", "Third Party Advisory"], "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Zoom Chat through 2021-04-09 on Windows and macOS allows certain remote authenticated attackers to execute arbitrary code without user interaction. An attacker must be within the same organization, or an external party who has been accepted as a contact. NOTE: this is specific to the Zoom Chat software, which is different from the chat feature of the Zoom Meetings and Zoom Video Webinars software."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2021-30480", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 9.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "acInsufInfo": false, "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "baseMetricV3": {"cvssV3": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}}, "publishedDate": "2021-04-09T23:15Z", "configurations": {"nodes": [{"children": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:zoom:chat:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "2021-04-09"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false}]}], "operator": "AND", "cpe_match": []}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2021-09-21T17:46Z"}

8.8 /10