Vulnerability identifier: #VU63587

Vulnerability risk: Medium

CVSSv3.1: 4.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-22784

CWE-ID: CWE-91

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Zoom Client for Windows
Client/Desktop applications / Office applications
Zoom Client for Linux
Client/Desktop applications / Office applications
Zoom Client for macOS
Client/Desktop applications / Office applications
Zoom Client for Android
Mobile applications / Apps for mobile phones
Zoom Client for iOS
Mobile applications / Apps for mobile phones

Vendor: Zoom Video Communications, Inc.

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to improper input validation when processing XML data inside XMPP messages. A remote attacker can send a specially crafted chat message to break out of the current XMPP message context and spoof messages from other application users or from server.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Zoom Client for Windows: 4.0.35295.0605 - 5.5.4 13142.0301

Zoom Client for Linux: 5.1.418436.0628 - 5.9.6 2225

Zoom Client for macOS: 4.6.9 19273.0402 - 5.9.6 4993

Zoom Client for Android: 4.6.11 20553.0413 - 5.9.6 4756

Zoom Client for iOS: 4.6.10 20012.0407 - 5.9.6 2729

---

External links
http://explore.zoom.us/en/trust/security/security-bulletin/#ZSB-22006

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.