CVE-2023-34120 - CVE House
Back to Database
Status published High CVE-2023-34120

Improper privilege management in Zoom for Windows, Zoom Rooms for...

Vulnerability Description

Improper privilege management in Zoom for Windows, Zoom Rooms for Windows, and Zoom VDI for Windows clients before 5.14.0 may allow an authenticated user to potentially enable an escalation of privilege via local access. Users may potentially utilize higher level system privileges maintained by the Zoom client to spawn processes with escalated privileges.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-34120

Credits & Attribution

No credits recorded in the NVD database.

References

More from Zoom Video Communications, Inc.

View All →
CVE-2024-27247
Zoom Desktop Client for macOS - Improper Privilege Management
Medium 5.5
CVE-2024-27244
Zoom Workplace VDI App for Windows - Insufficient Verification of Data Authenticity
Medium 6.7
CVE-2024-27243
Zoom Apps - Buffer Overflow
Medium 6.5
CVE-2024-27242
Zoom Desktop Client for Linux - Cross Site Scripting
Medium 4.1
CVE-2024-24699
Zoom Clients - Business Logic Error
Medium 6.5

Affected Vendor

Zoom Video Communications, Inc.

View all reports →

Affected Software

Zoom for Windows Client, Zoom Rooms Client for Windows, Zoom VDI for Windows Meeting Clients
Vulnerable Versions:
before 5.14.0

Timeline

Official Publish: June 13th, 2023
Last Modified: January 2nd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L

Weaknesses (CWE)

CWE-347

MITRE ATT&CK TTPs

T1553 Subvert Trust Controls
Defense Evasion
T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1550 Use Alternate Authentication Material
Defense Evasion
T1565 Data Manipulation
Impact