Lucene search

ZoomCVELIST:CVE-2022-28760

HistoryOct 14, 2022 - 2:51 p.m.

CVE-2022-28760 Zoom On-Premise Deployments: Improper Access Control

2022-10-1414:51:16

CWE-284

Zoom

www.cve.org

zoom

meeting connector

improper access control

vulnerability

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

28.4%

JSON

Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions.

CNA Affected

[
  {
    "vendor": "Zoom Video Communications Inc",
    "product": "Zoom On-Premise Meeting Connector MMR",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "4.8.20220815.130",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

explore.zoom.us/en/trust/security/security-bulletin/

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS

0.001

Percentile

28.4%

JSON

Related for CVELIST:CVE-2022-28760