CVE-2022-22787

🗓️ 18 May 2022 16:03:18Reported by ZoomType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 135 Views

The Zoom Client for Meetings fails to properly validate hostname during server switch reques

Reporter	Title	Published	Views	Family All 18
ATTACKERKB	CVE-2022-22787	17 May 202212:00	–	attackerkb
BDU FSTEC	The vulnerability of clients for conducting real-time audio and video conferences via Zoom Client for Meetings on Android, iOS, Linux, macOS, and Windows lies in the improper validation of the host name during the server switching process. This allows attackers to execute a “man-in-the-middle” attack.	29 Jun 202200:00	–	bdu_fstec
Circl	CVE-2022-22787	25 May 202217:27	–	circl
CNNVD	Zoom Client 信任管理问题漏洞	18 May 202200:00	–	cnnvd
Cvelist	CVE-2022-22787 Insufficient hostname validation during Clusterswitch message in Zoom Client for Meetings	18 May 202216:03	–	cvelist
EUVD	EUVD-2022-27930	3 Oct 202520:07	–	euvd
Kaspersky	KLA12539 Multiple vulnerabilities in Zoom	17 May 202200:00	–	kaspersky
Tenable Nessus	Zoom Client < 5.10.0 Multiple Vulnerabilities (macOS)	7 Sep 202200:00	–	nessus
Tenable Nessus	Zoom Client < 5.10.0 Attack Chain Vulnerabilities	1 Jun 202200:00	–	nessus
Tenable Nessus	Zoom Client for Meetings < 5.10.0 Vulnerability (ZSB-22009)	15 Dec 202200:00	–	nessus

NVD

Node

zoom meetingsRange<5.10.0android

zoom meetingsRange<5.10.0iphone_os

zoom meetingsRange<5.10.0linux

zoom meetingsRange<5.10.0macos

zoom meetingsRange<5.10.0windows

[
  {
    "product": "Zoom Client for Meetings for Android",
    "vendor": "Zoom Video Communications Inc",
    "versions": [
      {
        "lessThan": "5.10.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Zoom Client for Meetings for iOS",
    "vendor": "Zoom Video Communications Inc",
    "versions": [
      {
        "lessThan": "5.10.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Zoom Client for Meetings for Linux",
    "vendor": "Zoom Video Communications Inc",
    "versions": [
      {
        "lessThan": "5.10.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Zoom Client for Meetings for MacOS",
    "vendor": "Zoom Video Communications Inc",
    "versions": [
      {
        "lessThan": "5.10.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "Zoom Client for Meetings for Windows",
    "vendor": "Zoom Video Communications Inc",
    "versions": [
      {
        "lessThan": "5.10.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
explore	www.explore.zoom.us/en/trust/security/security-bulletin
packetstormsecurity	www.packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html