CVE-2019-13450
In the Zoom Client through 4.4.4 and RingCentral 7.0.136380.0312 on macOS, remote attackers can force a user to join a video call with the video camera active. This occurs because any web site can interact with the Zoom web server on localhost port 19421 or 19424. NOTE: a machine remains vulnerable if the Zoom Client was installed in the past and then uninstalled. Blocking exploitation requires additional steps, such as the ZDisableVideo preference and/or killing the web server, deleting the ~/.zoomus directory, and creating a ~/.zoomus plain file.
- Affected products
- Ringcentral, Zoom Client
- Ringcentral
- = 7.0.136380.0312
- Zoom
- ≤ 4.4.4
- CVSS 3.0
- 6.5 MEDIUM
- EPSS
- 3.5% (88th percentile)
- Weakness
- CWE-862
- NVD status
- Modified
- Published
- 2019-07-09
No indexed exploits for CVE-2019-13450 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2019-13450 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.