Improper access control in Zoom On-Premise Meeting Connector

Published: 2022-08-18

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2022-28753 CVE-2022-28754
CWE-ID	CWE-284
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Zoom Meeting Connector Server applications / Conferencing, Collaboration and VoIP solutions
Vendor	Zoom Video Communications, Inc.

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Improper access control

EUVDB-ID: #VU66602

Risk: Medium

CVSSv4.0: 5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-28753

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and join the meeting they are authorized to join without appearing to the other participants, can admit themselves into the meeting from the waiting room, and can become host and cause other meeting disruptions.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Zoom Meeting Connector: 1.0.23635.0520 - 4.8.113.20220526

CPE2.3

External links

https://explore.zoom.us/en/trust/security/security-bulletin/#ZSB-22014

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper access control

EUVDB-ID: #VU66603