CVE-2022-22787

moderate-risk
Published 2022-05-18

The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0 fails to properly validate the hostname during a server switch request. This issue could be used in a more sophisticated attack to trick an unsuspecting users client to connect to a malicious server when attempting to use Zoom services.

Do I need to act?

-
0.33% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.9/10 Medium
NETWORK / HIGH complexity

Affected Products (5)

Affected Vendors

Zoom

References (4)

Third Party Advisory http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Co...
Vendor Advisory https://explore.zoom.us/en/trust/security/security-bulletin
Third Party Advisory http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Co...
Vendor Advisory https://explore.zoom.us/en/trust/security/security-bulletin
31
/ 100
moderate-risk
Severity 18/34 · Moderate
Exploitability 1/34 · Minimal
Exposure 12/34 · Low