Paper/Archive/CVE-2022-22785

CVE-2022-22785

Zoom Video Communications Inc Zoom Client for Meetings for Android — Improperly constrained session cookies in Zoom Client for Meetings

EPSS 4%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (NVD)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 89.2.892 × 2017.8 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom domains. This issue could be used in a more sophisticated attack to send an unsuspecting users Zoom-scoped session cookies to a non-Zoom domain. This could potentially allow for spoofing of a Zoom user.

Affected

ProductAffectedFixed inSource

Zoom Client for Meetings for Androidunspecified – < 5.10.05.10.0CNA

Zoom Client for Meetings for iOSunspecified – < 5.10.05.10.0CNA

Zoom Client for Meetings for Linuxunspecified – < 5.10.05.10.0CNA

Zoom Client for Meetings for MacOSunspecified – < 5.10.05.10.0CNA

Zoom Client for Meetings for Windowsunspecified – < 5.10.05.10.0CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Zoom (CNA)5.9CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L

References

refexplore.zoom.us/en/trust/security/security-bulletin