CVE-2022-28755 - CVE House

Back to Database

Status published Critical CVE-2022-28755

Improper URL parsing in Zoom Clients

9.6 CVSS

Vulnerability Description

The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.11.0 are susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attacks including the potential for remote code execution through launching executables from arbitrary paths.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-28755

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

https://explore.zoom.us/en/trust/security/security-bulletin/

More from Zoom Video Communications Inc

View All →

Improper trust boundary implementation for SMB in Zoom Clients

Local Privilege Escalation in Zoom for macOS Installers

Local Privilege Escalation in Zoom for Windows Installers

Denial of Service in Zoom Clients

Denial of Service in Zoom Clients

Affected Vendor

Zoom Video Communications Inc

View all reports →

Affected Software

Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows), Zoom VDI Windows Meeting Clients

Vulnerable Versions:

unspecified

Timeline

Official Publish: August 11th, 2022

Last Modified: September 17th, 2024

Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1059 Command and Scripting Interpreter

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1213 Data from Information Repositories

T1565.002 Stored Data Manipulation