Lucene search

ZoomCVE-2022-28758

HistorySep 16, 2022 - 10:15 p.m.

CVE-2022-28758

2022-09-1622:15:10

CWE-284

Zoom

web.nvd.nist.gov

cve-2022-28758

zoom

meeting connector

mmr

access control

vulnerability

security

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

AI Score

8.1

Confidence

High

EPSS

0.002

Percentile

51.4%

JSON

Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions.

Affected configurations

Nvd

Node

zoomzoom_on-premise_meeting_connector_mmrRange<4.8.20220815.130

VendorProductVersionCPE
zoomzoom_on-premise_meeting_connector_mmr*cpe:2.3:a:zoom:zoom_on-premise_meeting_connector_mmr:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zoom	zoom_on-premise_meeting_connector_mmr	*	cpe:2.3:a:zoom:zoom_on-premise_meeting_connector_mmr::::::::

CNA Affected

[
  {
    "product": "Zoom On-Premise Meeting Connector MMR",
    "vendor": "Zoom Video Communications Inc",
    "versions": [
      {
        "lessThan": "4.8.20220815.130",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

explore.zoom.us/en/trust/security/security-bulletin/

Social References

CVSS3

8.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

AI Score

8.1

Confidence

High

EPSS

0.002

Percentile

51.4%

JSON

Related for CVE-2022-28758