Vulnerability in Zoom Meetings
CVE-2022-22782
The Zoom Client for Meetings for Windows prior to version 5.9.7, Zoom Rooms for Conference Room for Windows prior to version 5.10.0, Zoom Plugins for Microsoft Outlook for Windows prior to version 5.10.3, and Zoom VDI Windows Meeting Clients prior to version 5.9.6; was susceptible to a local privilege escalation issue during the installer repair operation. A malicious actor could utilize this to potentially delete system level files or folders, causing integrity or availability issues on the user’s host machine.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.9 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H.
EPSS exploit prediction
EPSS: 0.004 (29.0th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 29th percentile — 29.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: +0.000
Affected products
- Zoom Meetings
- Zoom Rooms For Conference
- Zoom Vdi Windows Meeting Clients
- Zoom Plugin For Microsoft Outlook
- Zoom Video Communications Inc Client For Meetings Windows — versions unspecified
- Zoom Video Communications Inc Plugins For Microsoft Outlook Windows — versions unspecified
- Zoom Video Communications Inc Rooms For Conference Room Windows — versions unspecified
- Zoom Video Communications Inc Vdi Windows Meeting Clients — versions unspecified
References
- explore.zoom.us/en/trust/security/security-bulletin/ (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-22782?
- CVE-2022-22782 is a high-severity vulnerability in Zoom Meetings. CVSS score: 7.9/10. Published 2022-04-28.
- How severe is CVE-2022-22782?
- High severity. CVSS v3 base score is 7.9 out of 10.