#VU63587 XML injection in Zoom Video Communications, Inc. products - CVE-2022-22784

Vulnerability identifier: #VU63587

Vulnerability risk: Medium

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-22784

CWE-ID: CWE-91

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Zoom Workplace Desktop App for Windows
Client/Desktop applications / Office applications
Zoom Workplace Desktop App for Linux
Client/Desktop applications / Office applications
Zoom Workplace Desktop App for macOS
Client/Desktop applications / Office applications
Zoom Workplace App for Android
Mobile applications / Apps for mobile phones
Zoom Workplace App for iOS
Mobile applications / Apps for mobile phones

Vendor: Zoom Video Communications, Inc.

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to improper input validation when processing XML data inside XMPP messages. A remote attacker can send a specially crafted chat message to break out of the current XMPP message context and spoof messages from other application users or from server.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Zoom Workplace Desktop App for Windows: 4.0.35295.0605 - 5.5.4 13142.0301

Zoom Workplace Desktop App for Linux: 5.1.418436.0628 - 5.9.6 2225

Zoom Workplace Desktop App for macOS: 4.6.9 19273.0402 - 5.9.6 4993

Zoom Workplace App for Android: 4.6.11 20553.0413 - 5.9.6 4756

Zoom Workplace App for iOS: 4.6.10 20012.0407 - 5.9.6 2729

---

External links
https://explore.zoom.us/en/trust/security/security-bulletin/#ZSB-22006

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.