CVE-2023-39212

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Untrusted search path in Zoom Rooms for Windows before version 5.15.5 may allow an authenticated user to enable a denial of service via local access.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-144CWE-426

Affected software

VendorProductVersions
Zoom Video Communications, Inc.Zoom Rooms for Windowsbefore 5.15.5

References

Timeline

Published
Aug 8, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-392139.8Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before 5.15.2 may allow an unauthenticateCVE-2023-392148.1Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via netwoCVE-2023-392156.5Improper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network access.CVE-2023-392169.8Improper input validation in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of privCVE-2023-392177.5Improper input validation in Zoom SDK’s before 5.14.10 may allow an unauthenticated user to enable a denial of service via network access.CVE-2023-392184.9Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow a privileged user to enable information disclosure CVE-2023-392197.5PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumerCVE-2023-39227.1An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.CVE-2023-392218.8Improper access control for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via netCVE-2023-392228.8OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary CVE-2023-392235.4Stored cross-site scripting vulnerability exists in CGIs included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerabiliCVE-2023-392248.0Archer C5 firmware all versions and Archer C7 firmware versions prior to 'Archer C7(JP)_V2_230602' allow a network-adjacent authenticated at
CVE-2023-39212: Medium severity, CVSS 5.5 | Vulnix