Update package downgrade in Zoom Client for Meetings for Windows
CVE-2022-22786

7.5HIGH

Key Information:

Summary

The Zoom Client for Meetings for Windows before version 5.10.0 and Zoom Rooms for Conference Room for Windows before version 5.10.0, fails to properly check the installation version during the update process. This issue could be used in a more sophisticated attack to trick a user into downgrading their Zoom client to a less secure version.

Affected Version(s)

Zoom Client for Meetings for Windows < 5.10.0

Zoom Rooms for Conference Room for Windows < 5.10.0

References

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ivan Fratric of Google Project Zero
.
πŸͺ This website uses cookies, like every other website on the internet πŸ˜• By using our website, you consent to the use of cookies.