PT-2022-19216 · Zoom · Zoom Client For Meetings

Published 2022-10-14 · Updated 2022-10-19 · CVE-2022-28762

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoom Client for Meetings for macOS (Standard and for IT Admin) versions 5.10.6 through 5.11.x

Description The issue is related to a debugging port misconfiguration in the Zoom client. When the camera mode rendering context is enabled as part of the Zoom App Layers API by running certain Zoom Apps, a local debugging port is opened by the Zoom client. A local malicious user could use this debugging port to connect to and control the Zoom Apps running in the Zoom client. This could potentially allow the malicious user to capture sensitive data, such as passwords and access tokens, or to capture audio or video without entering the application.

Recommendations For Zoom Client for Meetings for macOS (Standard and for IT Admin) versions 5.10.6 through 5.11.x, update to version 5.12.0 or later to resolve the issue. As a temporary workaround, consider disabling the use of the Zoom App Layers API or restricting access to the debugging port until the update is applied.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2022-28762

Affected Products

Zoom Client For Meetings

References · 5

• https://explore.zoom.us/en/trust/security/security-bulletin · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-28762 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28762 · Security Note
• https://t.me/echeloneyes/791 · Telegram Post
• https://t.me/cibsecurity/51423 · Telegram Post