CVE-2022-28763CWE-20

Improper URL parsing in Zoom Clients

High · published October 31, 2022

CVSS v3.1
8.8
EPSS
1%
Percentile
69.4
In the wild
Unconfirmed
What it is

The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.2 is susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attacks including session takeovers.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01260 · 69.4th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2022-10-31T19:49Z
EPSS history
Timeline
  • 31 OCT 19:49Z
    Improper URL parsing in Zoom Clients
    cvelistv5