PT-2022-5831 · Zoom · Zoom Client For Meetings+1

Published 2022-08-11 · Updated 2022-08-18 · CVE-2022-28755

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Zoom Client for Meetings versions prior to 5.11.0

Description The issue is related to a URL parsing problem. If a malicious Zoom meeting URL is opened, it may direct the user to connect to an arbitrary network address, potentially leading to additional attacks, including remote code execution through launching executables from arbitrary paths. The vulnerability can be exploited by a remote attacker using a specially crafted malicious URL, allowing for the potential execution of arbitrary code.

Recommendations For versions prior to 5.11.0, update to version 5.11.0 or later to resolve the issue. As a temporary workaround, consider avoiding the use of potentially malicious Zoom meeting URLs until the update is applied. Restrict access to untrusted URLs to minimize the risk of exploitation.

Fix

RCE

Open Redirect

Weakness Enumeration

CWE-601

CWE-20

Related Identifiers

BDU:2022-07243

CVE-2022-28755

Affected Products

Zoom Client For Meetings

Zoom

References · 4

• https://bdu.fstec.ru/vul/2022-07243 · Security Note
• https://explore.zoom.us/en/trust/security/security-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28755 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28755 · Vendor Advisory