PT-2022-19211 · Zoom · Zoom On-Premise Meeting Connector Mmr

Published 2022-09-16 · Updated 2022-09-21 · CVE-2022-28758

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Zoom On-Premise Meeting Connector MMR versions prior to 4.8.20220815.130

Description The issue allows a malicious actor to obtain the audio and video feed of a meeting they were not authorized to join, causing meeting disruptions due to improper access control.

Recommendations For versions prior to 4.8.20220815.130, update to version 4.8.20220815.130 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive meetings and implementing additional authentication measures to minimize the risk of unauthorized access.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2022-28758

Affected Products

Zoom On-Premise Meeting Connector Mmr

References · 4

• https://explore.zoom.us/en/trust/security/security-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28758 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28758 · Vendor Advisory
• https://t.me/cvenotify/36621 · Telegram Post