CVE-2020-6109 Path traversal in Zoom
An attacker can achieve arbitrary code execution by sending a specially crafted chat message with an animated GIF to a Zoom user.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-6109?
CVE-2020-6109 is a high-severity path traversal vulnerability in Zoom Zoom, published on 8 Jun 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An exploitable path traversal vulnerability exists in the Zoom client, version 4.6.10 processes messages including animated GIFs. A specially crafted chat message can cause an arbitrary file write, which could potentially be abused to achieve arbitrary code execution. An attacker needs to send a specially crafted message to a target user or a group to exploit this vulnerability.
Weakness: CWE-22
Which versions are affected by CVE-2020-6109?
It affects 1 product.
Products include Zoom Zoom.
How do I fix CVE-2020-6109?
No fix has been published for CVE-2020-6109 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2020-6109 being exploited?
There is no known exploitation of CVE-2020-6109 in the wild and no public exploit code.
Other vulnerabilities in Zoom Zoom
Sources
Also known as GHSA-j63p-5452-5xv5.