Cyber Resilience

CVE-2022-22785

Medium

Published: 18 May 2022

Published
18 May 2022
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L
EPSS Score 0.0018 39.8th percentile
Risk Priority 12 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-22785 is a medium-severity Reliance on Cookies without Validation and Integrity Checking (CWE-565) vulnerability in Zoom Meetings. Its CVSS base score is 5.9 (Medium).

Operationally, ranked at the 39.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom domains. This issue could be used in a more sophisticated attack to send an unsuspecting users…

more

Zoom-scoped session cookies to a non-Zoom domain. This could potentially allow for spoofing of a Zoom user.

CWE(s)
CWE-565

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

zoom
meetings
≤ 5.10.0 · ≤ 5.10.0 · ≤ 5.10.0

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References