#VU66603 Improper access control in Zoom Meeting Connector - CVE-2022-28754

Vulnerability identifier: #VU66603

Vulnerability risk: Medium

CVSSv4.0: 5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2022-28754

CWE-ID: CWE-284

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Zoom Meeting Connector
Server applications / Conferencing, Collaboration and VoIP solutions

Vendor: Zoom Video Communications, Inc.

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions. A remote user can bypass implemented security restrictions and join the meeting they are authorized to join without appearing to the other participants, can admit themselves into the meeting from the waiting room, and can become host and cause other meeting disruptions.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Zoom Meeting Connector: 1.0.23635.0520 - 4.8.113.20220526

---

External links
https://explore.zoom.us/en/trust/security/security-bulletin/#ZSB-22014

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.