Insufficient hostname validation during Clusterswitch message in Zoom Client for Meetings
CVE-2022-22787

5.9MEDIUM

Key Information:

Vendor

Zoom
Status
Zoom Client For Meetings For Android
Zoom Client For Meetings For iOS
Zoom Client For Meetings For Linux
Zoom Client For Meetings For Mac OS
Vendor
CVE Published:
18 May 2022

What is CVE-2022-22787?

The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0 fails to properly validate the hostname during a server switch request. This issue could be used in a more sophisticated attack to trick an unsuspecting users client to connect to a malicious server when attempting to use Zoom services.

Affected Version(s)

Zoom Client for Meetings for Android < 5.10.0

Zoom Client for Meetings for iOS < 5.10.0

Zoom Client for Meetings for Linux < 5.10.0

References

https://explore.zoom.us/en/trust/security/security-bulletin
x_refsource_CONFIRM
http://packetstormsecurity.com/files/167238/Zoom-XMPP-Sta...
x_refsource_MISC

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ivan Fratric of Google Project Zero
.