Lucene search

ZoomCVE-2022-28760

HistoryOct 14, 2022 - 3:15 p.m.

CVE-2022-28760

2022-10-1415:15:16

CWE-284

Zoom

web.nvd.nist.gov

cve-2022-28760

zoom

on-premise

meeting connector

mmr

version 4.8.20220815.130

improper access control

vulnerability

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

28.4%

JSON

Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions.

Affected configurations

Nvd

Node

zoomzoom_on-premise_meeting_connector_mmrRange<4.8.20220815.130

VendorProductVersionCPE
zoomzoom_on-premise_meeting_connector_mmr*cpe:2.3:a:zoom:zoom_on-premise_meeting_connector_mmr:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
zoom	zoom_on-premise_meeting_connector_mmr	*	cpe:2.3:a:zoom:zoom_on-premise_meeting_connector_mmr::::::::

CNA Affected

[
  {
    "vendor": "Zoom Video Communications Inc",
    "product": "Zoom On-Premise Meeting Connector MMR",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "4.8.20220815.130",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

References

explore.zoom.us/en/trust/security/security-bulletin/

Social References

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.4

Confidence

High

EPSS

0.001

Percentile

28.4%

JSON

Related for CVE-2022-28760