{"api_version":"1","generated_at":"2026-07-23T13:16:33+00:00","cve":"CVE-2019-13567","urls":{"html":"https://cve.report/CVE-2019-13567","api":"https://cve.report/api/cve/CVE-2019-13567.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2019-13567","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-13567"},"summary":{"title":"CVE-2019-13567","description":"The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon (aka the hidden web server) is running, but the Zoom Client is not installed or can't be opened, an attacker can remotely execute code with a maliciously crafted launch URL. NOTE: ZoomOpener is removed by the Apple Malware Removal Tool (MRT) if this tool is enabled and has the 2019-07-10 MRTConfigData.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2019-07-12 04:15:00","updated_at":"2020-08-24 17:37:00"},"problem_types":["CWE-78"],"metrics":[],"references":[{"url":"https://gist.github.com/wbowling/13f9f90365c171806b9ffba2c841026b","name":"https://gist.github.com/wbowling/13f9f90365c171806b9ffba2c841026b","refsource":"MISC","tags":["Third Party Advisory"],"title":"Zoom RCE - CVE-2019-13567 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://twitter.com/wcbowling/status/1166998107667619841","name":"https://twitter.com/wcbowling/status/1166998107667619841","refsource":"MISC","tags":["Third Party Advisory"],"title":"William Bowling na Twitterze: \"Here are the details on the Zoom RCE (CVE-2019-13567) that we sent to mitre, worked on the latest (and last) ZoomOpener which had the host check and signature verification https://t.co/4x8AW4YkR9\"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://support.zoom.us/hc/en-us/articles/201361963-New-Updates-for-Mac-OS","name":"https://support.zoom.us/hc/en-us/articles/201361963-New-Updates-for-Mac-OS","refsource":"MISC","tags":["Release Notes","Vendor Advisory"],"title":"New Updates for Mac OS – Zoom Support Center","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://twitter.com/wcbowling/status/1149457231504498689","name":"https://twitter.com/wcbowling/status/1149457231504498689","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"William Bowling na Twitterze: \"So yes, there was an RCE in the hidden zoom web server...\n\nGreat work by @JLLeitschuh for the initial research, for more details on if you're affected see  https://t.co/8oJHpN8Cw5\n\nCVE-2019-13567… https://t.co/iqMqzUSzJs\"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://twitter.com/JLLeitschuh/status/1149422543658520578","name":"https://twitter.com/JLLeitschuh/status/1149422543658520578","refsource":"MISC","tags":["Third Party Advisory"],"title":"Jonathan Leitschuh di Twitter: \"Specifically, you are vulnerable if you've uninstalled the Zoom application from your computer without killing the ZoomOpener process and then deleting `~/.zoomus` directory.\n\nApple is rolling out a fix, but if you haven't gotten it yet, or you haven't updated, you are vulnerable… https://t.co/rPqgF8hFFO\"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://twitter.com/JLLeitschuh/status/1149420685405708295","name":"https://twitter.com/JLLeitschuh/status/1149420685405708295","refsource":"MISC","tags":["Third Party Advisory"],"title":"Jonathan Leitschuh di Twitter: \"???? RCE Alert! ????\n\nThat @zoom_us daemon (hidden web server) is now known to have a Remote Code Execution Vulnerability!\n\n????Proof of concepts exist! ????\n\nMac Admins: make sure Zoom is up to date or that daemon is removed!\n\nThis vulnerability is now tracked under:\nCVE-2019-13567… https://t.co/a9pseiLGY8\"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://twitter.com/riskybusiness/status/1149125147019767814","name":"https://twitter.com/riskybusiness/status/1149125147019767814","refsource":"MISC","tags":["Third Party Advisory"],"title":"Patrick Gray na Twitteru: \"So one more detail on the Zoom bug that I didn't know previously -- it only affected you if you'd installed Zoom then removed it, leaving behind its shitty little webserver. This is the first time I've seen software make people more vulnerable when they actually uninstalled it.\"","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-13567","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13567","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2019","cve_id":"13567","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"zoom","cpe5":"zoom","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"macos","cpe12":"*","cpe13":"*"},{"cve_year":"2019","cve_id":"13567","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"zoom","cpe5":"zoom","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"macos","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2019-13567","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon (aka the hidden web server) is running, but the Zoom Client is not installed or can't be opened, an attacker can remotely execute code with a maliciously crafted launch URL. NOTE: ZoomOpener is removed by the Apple Malware Removal Tool (MRT) if this tool is enabled and has the 2019-07-10 MRTConfigData."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"url":"https://twitter.com/riskybusiness/status/1149125147019767814","refsource":"MISC","name":"https://twitter.com/riskybusiness/status/1149125147019767814"},{"url":"https://twitter.com/JLLeitschuh/status/1149420685405708295","refsource":"MISC","name":"https://twitter.com/JLLeitschuh/status/1149420685405708295"},{"url":"https://twitter.com/wcbowling/status/1149457231504498689","refsource":"MISC","name":"https://twitter.com/wcbowling/status/1149457231504498689"},{"url":"https://twitter.com/JLLeitschuh/status/1149422543658520578","refsource":"MISC","name":"https://twitter.com/JLLeitschuh/status/1149422543658520578"},{"refsource":"MISC","name":"https://support.zoom.us/hc/en-us/articles/201361963-New-Updates-for-Mac-OS","url":"https://support.zoom.us/hc/en-us/articles/201361963-New-Updates-for-Mac-OS"},{"refsource":"MISC","name":"https://gist.github.com/wbowling/13f9f90365c171806b9ffba2c841026b","url":"https://gist.github.com/wbowling/13f9f90365c171806b9ffba2c841026b"},{"refsource":"MISC","name":"https://twitter.com/wcbowling/status/1166998107667619841","url":"https://twitter.com/wcbowling/status/1166998107667619841"}]}},"nvd":{"publishedDate":"2019-07-12 04:15:00","lastModifiedDate":"2020-08-24 17:37:00","problem_types":["CWE-78"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH"},"exploitabilityScore":2.8,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6.8},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:zoom:zoom:*:*:*:*:*:macos:*:*","versionEndExcluding":"4.4.53932.0709","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2019","CveId":"13567","Ordinal":"151927","Title":"CVE-2019-13567","CVE":"CVE-2019-13567","Year":"2019"},"notes":[{"CveYear":"2019","CveId":"13567","Ordinal":"1","NoteData":"The Zoom Client before 4.4.53932.0709 on macOS allows remote code execution, a different vulnerability than CVE-2019-13450. If the ZoomOpener daemon (aka the hidden web server) is running, but the Zoom Client is not installed or can't be opened, an attacker can remotely execute code with a maliciously crafted launch URL. NOTE: ZoomOpener is removed by the Apple Malware Removal Tool (MRT) if this tool is enabled and has the 2019-07-10 MRTConfigData.","Type":"Description","Title":null},{"CveYear":"2019","CveId":"13567","Ordinal":"2","NoteData":"2019-07-11","Type":"Other","Title":"Published"},{"CveYear":"2019","CveId":"13567","Ordinal":"3","NoteData":"2019-08-30","Type":"Other","Title":"Modified"}]}}}