CVE-2022-22787
5.9
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L
Summary
The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0 fails to properly validate the hostname during a server switch request. This issue could be used in a more sophisticated attack to trick an unsuspecting users client to connect to a malicious server when attempting to use Zoom services.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Zoom Video Communications Inc | Zoom Client for Meetings for Android | unspecified < 5.10.0 | affected |
| Zoom Video Communications Inc | Zoom Client for Meetings for iOS | unspecified < 5.10.0 | affected |
| Zoom Video Communications Inc | Zoom Client for Meetings for Linux | unspecified < 5.10.0 | affected |
| Zoom Video Communications Inc | Zoom Client for Meetings for MacOS | unspecified < 5.10.0 | affected |
| Zoom Video Communications Inc | Zoom Client for Meetings for Windows | unspecified < 5.10.0 | affected |
Weaknesses
- Improper Input Validation
ADP Enrichment
CVE Program Container
Additional References
- https://explore.zoom.us/en/trust/security/security-bulletin
- http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html
References
- https://explore.zoom.us/en/trust/security/security-bulletin
- http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.