Open Redirect in Zoom Meetings
CVE-2022-28763
The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.2 is susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to…
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.011 (62.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Affected products
- Zoom Meetings
- Zoom Rooms_for_conference_rooms
- Zoom Virtual_desktop_infrastructure
- Zoom Video Communications Inc Client For Meetings (For Android, Ios, Linux, Macos, And Windows) — versions unspecified
- Zoom Video Communications Inc Rooms For Conference Room (For Android, Ios, Linux, Macos, And Windows) — versions unspecified
- Zoom Video Communications Inc Vdi Windows Meeting Clients — versions unspecified
Weakness classification (CWE)
References
- security@zoom.us (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-28763?
- CVE-2022-28763 is a high-severity vulnerability in Zoom Meetings, classified under Improper Input Validation. CVSS score: 8.8/10. Published 2022-10-31.
- How severe is CVE-2022-28763?
- High severity. CVSS v3 base score is 8.8 out of 10.