CVE-2023-39213

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper neutralization of special elements in Zoom Desktop Client for Windows and Zoom VDI Client before 5.15.2 may allow an unauthenticated user to enable an escalation of privilege via network access.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-176 CWE-74

Affected software

Vendor	Product	Versions
Zoom Video Communications, Inc.	Zoom Desktop Client for Windows and Zoom VDI Client	before 5.15.2

References

https://explore.zoom.us/en/trust/security/security-bulletin/Vendor Advisory
https://explore.zoom.us/en/trust/security/security-bulletin/Vendor Advisory

Timeline

Published: Aug 8, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-392148.1Exposure of sensitive information in Zoom Client SDK's before 5.15.5 may allow an authenticated user to enable a denial of service via netwo CVE-2023-392156.5Improper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network access.CVE-2023-392169.8Improper input validation in Zoom Desktop Client for Windows before 5.14.7 may allow an unauthenticated user to enable an escalation of priv CVE-2023-392177.5Improper input validation in Zoom SDK’s before 5.14.10 may allow an unauthenticated user to enable a denial of service via network access.CVE-2023-392184.9Client-side enforcement of server-side security in Zoom clients before 5.14.10 may allow a privileged user to enable information disclosure CVE-2023-392197.5PingFederate Administrative Console dependency contains a weakness where console becomes unresponsive with crafted Java class loading enumer CVE-2023-39227.1An issue has been discovered in GitLab affecting all versions starting from 8.15 before 16.2.8, all versions starting from 16.3 before 16.3.CVE-2023-392218.8Improper access control for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via net CVE-2023-392228.8OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary CVE-2023-392235.4Stored cross-site scripting vulnerability exists in CGIs included in A.K.I Software's PMailServer/PMailServer2 products. If this vulnerabili CVE-2023-392248.0Archer C5 firmware all versions and Archer C7 firmware versions prior to 'Archer C7(JP)_V2_230602' allow a network-adjacent authenticated at CVE-2023-392269.8In Delta Electronics InfraSuite Device Master v.1.0.7, a vulnerability exists that allows an unauthenticated attacker to execute arbitrary c