Symlink following in the installer for the Zoom Workplace VDI Plugin macOS Universal installer before version 6.3.14, 6.4.14, and 6.5.10 in their respective tracks may allow an authenticated user to conduct a disclosure of information via network access.
Weakness
The product allows a file to be uploaded, but it relies on the file name or extension of the file to determine the appropriate behaviors. This could be used by attackers to cause the file to be misclassified and processed in a dangerous fashion.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Workplace_virtual_desktop_infrastructure | Zoom | * | 6.3.14 (excluding) |
| Workplace_virtual_desktop_infrastructure | Zoom | 6.4.0 (including) | 6.4.14 (excluding) |
| Workplace_virtual_desktop_infrastructure | Zoom | 6.5.0 (including) | 6.5.10 (excluding) |