CVE-2022-28755: Zoom Video Communications Inc Zoom Client for Meetings

Описание

Оригинално описание

The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.11.0 are susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attacks including the potential for remote code execution through launching executables from arbitrary paths.

Засегнати продукти

• Zoom Video Communications Inc Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows): unspecified преди 5.11.0
• Zoom Video Communications Inc Zoom VDI Windows Meeting Clients: unspecified преди 5.10.7

Вид слабост

• CWE-20 Неправилно валидиране на входните данни

История

Други уязвимости в Zoom Video Communications Inc Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows)

• 3.3CVE-2022-28764
• 8.8CVE-2022-28763
• 7.9CVE-2022-22782
• 5.3CVE-2021-34424
• 7.3CVE-2021-34423

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2022-28755
• https://nvd.nist.gov/vuln/detail/CVE-2022-28755
• https://explore.zoom.us/en/trust/security/security-bulletin/