Insufficient hostname validation during Clusterswitch message in Zoom Client for Meetings
CVE-2022-22787

5.9MEDIUM

Key Information:

Vendor: Zoom
Status: Zoom Client For Meetings For Android; Zoom Client For Meetings For iOS; Zoom Client For Meetings For Linux; Zoom Client For Meetings For Mac OS
Vendor: CVE Published:; 18 May 2022

Summary

The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0 fails to properly validate the hostname during a server switch request. This issue could be used in a more sophisticated attack to trick an unsuspecting users client to connect to a malicious server when attempting to use Zoom services.

Affected Version(s)

Zoom Client for Meetings for Android < 5.10.0

Zoom Client for Meetings for iOS < 5.10.0

Zoom Client for Meetings for Linux < 5.10.0

References

https://explore.zoom.us/en/trust/security/security-bulletin

x_refsource_CONFIRM

http://packetstormsecurity.com/files/167238/Zoom-XMPP-Sta...

x_refsource_MISC

CVSS V3.1

Score:

5.9

Severity:

MEDIUM

Confidentiality:

High

Integrity:

None

Availability:

High

Attack Vector:

Network

Attack Complexity:

High

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
May 18, 2022
Vulnerability Reserved
Jan 7, 2022

Credit

Ivan Fratric of Google Project Zero