CVE-2022-22785 is a vulnerability in Zoom Meetings
Published on May 18, 2022
Improperly constrained session cookies in Zoom Client for Meetings
The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom domains. This issue could be used in a more sophisticated attack to send an unsuspecting users Zoom-scoped session cookies to a non-Zoom domain. This could potentially allow for spoofing of a Zoom user.
Vulnerability Analysis
CVE-2022-22785 can be exploited with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity, and a small impact on availability.
Products Associated with CVE-2022-22785
Want to know whenever a new CVE is published for Zoom Meetings? stack.watch will email you.
Affected Versions
Zoom Video Communications Inc Zoom Client for Meetings for Android:- Version unspecified and below 5.10.0 is affected.
- Version unspecified and below 5.10.0 is affected.
- Version unspecified and below 5.10.0 is affected.
- Version unspecified and below 5.10.0 is affected.
- Version unspecified and below 5.10.0 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.