SB2022081050 - Remote code execution in Zoom Client for Meetings
Published: August 10, 2022 Updated: August 27, 2022
Security Bulletin ID
SB2022081050
Severity
High
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Input validation error (CVE-ID: CVE-2022-28755)
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to insufficient validation of user-supplied input when parsing meeting URL. A remote attacker can trick the victim to follow a specially crafted URL, which can direct the user to connect to an arbitrary network address, leading to additional attacks including the potential for remote code execution through launching executables from arbitrary paths.
Remediation
Install update from vendor's website.