#VU68271 Improper access control in Zoom Meeting Connector - CVE-2022-28761

Vulnerability identifier: #VU68271

Vulnerability risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-28761

CWE-ID: CWE-284

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Zoom Meeting Connector
Server applications / Conferencing, Collaboration and VoIP solutions

Vendor: Zoom Video Communications, Inc.

Description

The vulnerability allows a remote user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper access restrictions. A remote user in a meeting or webinar they are authorized to join can prevent participants from receiving audio and video causing meeting disruptions.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

Zoom Meeting Connector: 4.0.74356.1206 - 4.8.20220815.130

---

External links
https://explore.zoom.us/en/trust/security/security-bulletin/#ZSB-22022

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.