CVE-2025-0145 (GCVE-0-2025-0145)

Vulnerability from cvelistv5 – Published: 2025-01-30 19:45 – Updated: 2025-01-30 21:23
VLAI?
Title
Zoom Workplace Apps for Windows - Untrusted Search Path
Summary
Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local access.
Severity ?
4.6 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L
CWE
Assigner
References
Impacted products
Vendor Product Version
Zoom Communications, Inc Zoom Workplace Apps for Windows Affected: see references (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-0145",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-30T21:23:14.886270Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-01-30T21:23:22.776Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "platforms": [
            "Windows"
          ],
          "product": "Zoom Workplace Apps for Windows",
          "vendor": "Zoom Communications, Inc",
          "versions": [
            {
              "status": "affected",
              "version": "see references",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2025-01-14T13:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cb\u003e\u003cspan style=\"background-color: transparent;\"\u003eUntrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local access.\u003cbr\u003e\u003cbr\u003e\u003c/span\u003e\u003c/b\u003e"
            }
          ],
          "value": "Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local access."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-426",
              "description": "CWE-426 Untrusted Search Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-30T19:45:39.432Z",
        "orgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
        "shortName": "Zoom"
      },
      "references": [
        {
          "url": "https://www.zoom.com/en/trust/security-bulletin/zsb-25004/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Zoom Workplace Apps for Windows - Untrusted Search Path",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "99b9af0d-a833-4a5d-9e2f-8b1324f35351",
    "assignerShortName": "Zoom",
    "cveId": "CVE-2025-0145",
    "datePublished": "2025-01-30T19:45:39.432Z",
    "dateReserved": "2024-12-23T21:42:54.089Z",
    "dateUpdated": "2025-01-30T21:23:22.776Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-0145\",\"sourceIdentifier\":\"security@zoom.us\",\"published\":\"2025-01-30T20:15:34.547\",\"lastModified\":\"2025-08-20T12:38:30.887\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local access.\"},{\"lang\":\"es\",\"value\":\"La ruta de b\u00fasqueda no confiable en el instalador de algunas aplicaciones de Zoom Workplace para Windows puede permitir que un usuario autorizado realice una escalada de privilegios a trav\u00e9s del acceso local.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security@zoom.us\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L\",\"baseScore\":4.6,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.5,\"impactScore\":2.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"security@zoom.us\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-426\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zoom:meeting_software_development_kit:*:*:*:*:*:windows:*:*\",\"versionEndExcluding\":\"6.2.5\",\"matchCriteriaId\":\"A98C293E-D615-4807-B5D6-D3EACF6C2E5A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zoom:rooms:*:*:*:*:*:windows:*:*\",\"versionEndExcluding\":\"6.2.5\",\"matchCriteriaId\":\"5369DF52-B7F8-45BF-B431-747DFA54CF1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zoom:rooms_controller:*:*:*:*:*:windows:*:*\",\"versionEndExcluding\":\"6.2.5\",\"matchCriteriaId\":\"F57C8F45-FAE2-486D-83F4-0E938B62CBDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zoom:video_software_development_kit:*:*:*:*:*:windows:*:*\",\"versionEndExcluding\":\"6.2.5\",\"matchCriteriaId\":\"1126B8E5-38A9-4E00-9103-6C4EFDE6D60C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zoom:workplace_desktop:*:*:*:*:*:windows:*:*\",\"versionEndExcluding\":\"6.2.5\",\"matchCriteriaId\":\"6FC0F189-0F60-4EAB-9C35-0A62F06BFAC4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zoom:workplace_virtual_desktop_infrastructure:*:*:*:*:*:windows:*:*\",\"versionEndExcluding\":\"6.0.15\",\"matchCriteriaId\":\"645FDC99-C05E-4819-AA55-F9A80A98F567\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:zoom:workplace_virtual_desktop_infrastructure:*:*:*:*:*:windows:*:*\",\"versionStartIncluding\":\"6.0.16\",\"versionEndExcluding\":\"6.1.13\",\"matchCriteriaId\":\"9E06D46C-AE61-4533-A8F7-6E6CA9830155\"}]}]}],\"references\":[{\"url\":\"https://www.zoom.com/en/trust/security-bulletin/zsb-25004/\",\"source\":\"security@zoom.us\",\"tags\":[\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-0145\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-30T21:23:14.886270Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-30T21:23:18.810Z\"}}], \"cna\": {\"title\": \"Zoom Workplace Apps for Windows - Untrusted Search Path\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 4.6, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L\", \"integrityImpact\": \"LOW\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Zoom Communications, Inc\", \"product\": \"Zoom Workplace Apps for Windows\", \"versions\": [{\"status\": \"affected\", \"version\": \"see references\", \"versionType\": \"custom\"}], \"platforms\": [\"Windows\"], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2025-01-14T13:00:00.000Z\", \"references\": [{\"url\": \"https://www.zoom.com/en/trust/security-bulletin/zsb-25004/\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local access.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cb\u003e\u003cspan style=\\\"background-color: transparent;\\\"\u003eUntrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local access.\u003cbr\u003e\u003cbr\u003e\u003c/span\u003e\u003c/b\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-426\", \"description\": \"CWE-426 Untrusted Search Path\"}]}], \"providerMetadata\": {\"orgId\": \"99b9af0d-a833-4a5d-9e2f-8b1324f35351\", \"shortName\": \"Zoom\", \"dateUpdated\": \"2025-01-30T19:45:39.432Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-0145\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-01-30T21:23:22.776Z\", \"dateReserved\": \"2024-12-23T21:42:54.089Z\", \"assignerOrgId\": \"99b9af0d-a833-4a5d-9e2f-8b1324f35351\", \"datePublished\": \"2025-01-30T19:45:39.432Z\", \"assignerShortName\": \"Zoom\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.