Improper XML Parsing in Zoom Client for Meetings
CVE-2022-22784

8.1HIGH

Key Information:

Vendor
Zoom
Status
Zoom Client For Meetings For Android
Zoom Client For Meetings For iOS
Zoom Client For Meetings For Linux
Zoom Client For Meetings For Mac OS
Vendor
CVE Published:
18 May 2022

Summary

The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly parse XML stanzas in XMPP messages. This can allow a malicious user to break out of the current XMPP message context and create a new message context to have the receiving users client perform a variety of actions.This issue could be used in a more sophisticated attack to forge XMPP messages from the server.

Affected Version(s)

Zoom Client for Meetings for Android < 5.10.0

Zoom Client for Meetings for iOS < 5.10.0

Zoom Client for Meetings for Linux < 5.10.0

References

https://explore.zoom.us/en/trust/security/security-bulletin
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ivan Fratric of Google Project Zero
.