{
    "file_item": {
        "filepath": "security-advisories",
        "filename": "CERT-EU-SA2022-038.pdf"
    },
    "title": "Zoom Vulnerabilities",
    "serial_number": "2022-038",
    "publish_date": "27-05-2022 14:29:00",
    "description": "On the 17th of May 2022, Zoom released an advisory about two high vulnerabilities. They are tracked as CVE-2022-22786 with a CVSS score of 7.5 and CVE-2022-22784 with a CVSS score of 8.1. A successful exploitation of both of these vulnerabilities could be used in a more sophisticated attack to trick a user into downgrading their Zoom client to a less secure version and to forge XMPP messages from the server, respectively.",
    "url_title": "2022-038",
    "content_markdown": "---\ntitle: 'Zoom Vulnerabilities'\nversion: '1.0'\nnumber: '2022-038'\noriginal_date: 'May 17, 2022'\ndate: 'May 27, 2022'\n---\n\n_History:_\n\n* _27/05/2022 --- v1.0 -- Initial publication_\n\n# Summary\n\nOn the 17th of May 2022, Zoom released an advisory about two high vulnerabilities. They are tracked as CVE-2022-22786 with a CVSS score of 7.5 and CVE-2022-22784 with a CVSS score of 8.1.  A successful exploitation of both of these vulnerabilities could be used in a more sophisticated attack to trick a user into downgrading their Zoom client to a less secure version and to forge XMPP messages from the server, respectively [1,2].\n\n# Technical Details\n\nThe `CVE-2022-22786` affects the Zoom Client for Meetings for Windows and Zoom Rooms for Conference Room for Windows which fail to properly check the installation version during the update process.\n\nThe `CVE-2022-22784` affects the Zoom Client for Meetings which fails to properly parse XML stanzas in XMPP messages. This can allow a malicious user to break out of the current XMPP message context and create a new message context to have the receiving user\u2019s client perform a variety of actions. \n\n# Affected Products\n\n`CVE-2022-22786`\n\n- All Zoom Client for Meetings for Windows before version 5.10.0\n- All Zoom Rooms for Conference Room for Windows before version 5.10.0\n\n`CVE-2022-22784`\n\n- Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0\n\n# Recommendations \n\nCERT-EU strongly recommends applying the available updates as soon as possible.\n\n## Workarounds\n\nNo workarounds are available.\n\n# References\n\n[1] <https://explore.zoom.us/en/trust/security/security-bulletin/>\n\n[2] <https://bugs.chromium.org/p/project-zero/issues/detail?id=2254>\n",
    "content_html": "<p><em>History:</em></p><ul><li><em>27/05/2022 --- v1.0 -- Initial publication</em></li></ul><h2 id=\"summary\">Summary</h2><p>On the 17th of May 2022, Zoom released an advisory about two high vulnerabilities. They are tracked as CVE-2022-22786 with a CVSS score of 7.5 and CVE-2022-22784 with a CVSS score of 8.1. A successful exploitation of both of these vulnerabilities could be used in a more sophisticated attack to trick a user into downgrading their Zoom client to a less secure version and to forge XMPP messages from the server, respectively [1,2].</p><h2 id=\"technical-details\">Technical Details</h2><p>The <code>CVE-2022-22786</code> affects the Zoom Client for Meetings for Windows and Zoom Rooms for Conference Room for Windows which fail to properly check the installation version during the update process.</p><p>The <code>CVE-2022-22784</code> affects the Zoom Client for Meetings which fails to properly parse XML stanzas in XMPP messages. This can allow a malicious user to break out of the current XMPP message context and create a new message context to have the receiving user\u2019s client perform a variety of actions. </p><h2 id=\"affected-products\">Affected Products</h2><p><code>CVE-2022-22786</code></p><ul><li>All Zoom Client for Meetings for Windows before version 5.10.0</li><li>All Zoom Rooms for Conference Room for Windows before version 5.10.0</li></ul><p><code>CVE-2022-22784</code></p><ul><li>Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0</li></ul><h2 id=\"recommendations\">Recommendations</h2><p>CERT-EU strongly recommends applying the available updates as soon as possible.</p><h3 id=\"workarounds\">Workarounds</h3><p>No workarounds are available.</p><h2 id=\"references\">References</h2><p>[1] <a rel=\"noopener\" target=\"_blank\" href=\"https://explore.zoom.us/en/trust/security/security-bulletin/\">https://explore.zoom.us/en/trust/security/security-bulletin/</a></p><p>[2] <a rel=\"noopener\" target=\"_blank\" href=\"https://bugs.chromium.org/p/project-zero/issues/detail?id=2254\">https://bugs.chromium.org/p/project-zero/issues/detail?id=2254</a></p>",
    "licence": {
        "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)",
        "link": "https://creativecommons.org/licenses/by/4.0/",
        "restrictions": "https://cert.europa.eu/legal-notice",
        "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies"
    }
}