Update package downgrade in Zoom Client for Meetings for Windows
CVE-2022-22786
7.5HIGH
Key Information:
- Vendor
- Zoom
- Vendor
- CVE Published:
- 18 May 2022
Summary
The Zoom Client for Meetings for Windows before version 5.10.0 and Zoom Rooms for Conference Room for Windows before version 5.10.0, fails to properly check the installation version during the update process. This issue could be used in a more sophisticated attack to trick a user into downgrading their Zoom client to a less secure version.
Affected Version(s)
Zoom Client for Meetings for Windows < 5.10.0
Zoom Rooms for Conference Room for Windows < 5.10.0
References
CVSS V3.1
Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Ivan Fratric of Google Project Zero