XML injection in Zoom Video Communications, Inc. products - CVE-2022-22784

Vulnerability identifier: #VU63587

CSH Severity: Medium

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-22784

CWE-ID: CWE-91

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to improper input validation when processing XML data inside XMPP messages. A remote attacker can send a specially crafted chat message to break out of the current XMPP message context and spoof messages from other application users or from server.

Zoom Workplace Desktop App for Windows
Zoom Workplace Desktop App for macOS
Zoom Workplace Desktop App for Linux
Zoom Workplace App for iOS
Zoom Workplace App for Android

Install updates from vendor's website.

Zoom Workplace Desktop App for Windows - update to 5.10.0 4306
Zoom Workplace Desktop App for macOS - update to 5.10.0 5714
Zoom Workplace App for iOS - update to 5.10.0 2988
Zoom Workplace App for Android - update to 5.10.0 5129
Zoom Workplace Desktop App for Linux - update to 5.10.0 2450

• https://explore.zoom.us/en/trust/security/security-bulletin/#ZSB-22006

• Multiple vulnerabilities in Zoom Client