CVE-2023-36536

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Untrusted search path in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

Vendor	Product	Versions
Zoom Video Communications, Inc.	Zoom Rooms for Windows	before 5.15.0

References

https://explore.zoom.us/en/trust/security/security-bulletin/Vendor Advisory
https://explore.zoom.us/en/trust/security/security-bulletin/Vendor Advisory

Timeline

Published: Jul 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-365377.8Improper privilege management in Zoom Rooms for Windows before version 5.14.5 may allow an authenticated user to enable an escalation of pri CVE-2023-365387.8Improper access control in Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege CVE-2023-365397.5Exposure of information intended to be encrypted by some Zoom clients may lead to disclosure of sensitive information.CVE-2023-36549.8cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a origi CVE-2023-365407.8Untrusted search path in the installer for Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escala CVE-2023-365418.8Insufficient verification of data authenticity in Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an CVE-2023-365428.8Apache NiFi 0.0.2 through 1.22.0 include Processors and Controller Services that support HTTP URL references for retrieving drivers, which a CVE-2023-365436.5Apache Airflow, versions before 2.6.3, has a vulnerability where an authenticated user can use crafted input to make the current request han CVE-2023-365479.8A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.CVE-2023-365489.8A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.CVE-2023-365499.8A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.CVE-2023-36557.5cashIT! - serving solutions. Devices from "PoS/ Dienstleistung, Entwicklung & Vertrieb GmbH" to 03.A06rks 2023.02.37 are affected by a dange