CVE-2019-13567 Command injection in n/a
Attackers can execute arbitrary code on macOS via a malicious launch URL if the ZoomOpener daemon is active, requiring an upgrade to the Zoom client.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2019-13567?
CVE-2019-13567 is a high-severity command injection vulnerability in Zoom Zoom, published on 12 Jul 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon (aka the hidden web server) is running, but the Zoom Client is not installed or can't be opened, an attacker can remotely execute code with a maliciously crafted launch URL. NOTE: ZoomOpener is removed by the Apple Malware Removal Tool (MRT) if this tool is enabled and has the 2019-07-10 MRTConfigData.
Weakness: CWE-78
Which versions are affected by CVE-2019-13567?
It affects 1 product.
Products include Zoom Zoom.
How do I fix CVE-2019-13567?
No fix has been published for CVE-2019-13567 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-13567 being exploited?
There is no known exploitation of CVE-2019-13567 in the wild and no public exploit code.
Other vulnerabilities in Zoom Zoom
Sources
Also known as GHSA-prr3-rc8j-qpm3.