Vulnerability in Zoom Meetings
CVE-2022-22788
The Zoom Opener installer is downloaded by a user from the Launch meeting page, when attempting to join a meeting without having the Zoom Meeting Client installed. The Zoom Opener installer for Zoom Client for Meetings before version 5.10.3 and Zoom Rooms for Conference Room for Windows before version 5.10.3 are susceptible to a DLL injection attack. This vulnerability could be used to run arbitrary code on the victims host.
EPSS: 0.014 (70.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Zoom Meetings
- Zoom Rooms
- Zoom Video Communications Inc All Rooms For Conference Room Windows — versions unspecified
- Zoom Video Communications Inc Client For Meetings — versions unspecified
Weakness classification (CWE)
References
- security@zoom.us (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-22788?
- CVE-2022-22788 is a high-severity vulnerability in Zoom Meetings, classified under Uncontrolled Search Path Element. CVSS score: 7.1/10. Published 2022-06-15.
- How severe is CVE-2022-22788?
- High severity. CVSS v3 base score is 7.1 out of 10.