Vulnerabilities > CVE-2022-28750 - Out-of-bounds Write vulnerability in Zoom Meeting Connector

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

zoom

CWE-787

critical

NVD

Published: 2022-08-11

Updated: 2022-08-18

Summary

Zoom On-Premise Meeting Connector Zone Controller (ZC) before version 4.8.20220419.112 fails to properly parse STUN error codes, which can result in memory corruption and could allow a malicious actor to crash the application. In versions older than 4.8.12.20211115, this vulnerability could also be leveraged to execute arbitrary code.

Vulnerable Configurations

Part	Description	Count
Application	Zoom Zoom Meeting Connector 1.0.23635.0520 Zoom Meeting Connector 1.0.23635.0911 Zoom Meeting Connector 1.0.31398.1104 Zoom Meeting Connector 1.0.34775.1213 Zoom Meeting Connector 2.5.863.0609 Zoom Meeting Connector 3.6.43993.0312 Zoom Meeting Connector 4.0.74356.1206 Zoom Meeting Connector 4.3.36476.0327 Zoom Meeting Connector 4.3.98838.1114 Zoom Meeting Connector 4.3.114891.1123 Zoom Meeting Connector 4.3.134251.1029 Zoom Meeting Connector 4.5.546.20200116 Zoom Meeting Connector 4.5.201900.0926 Zoom Meeting Connector 4.6.148.20200430 Zoom Meeting Connector 4.6.159.20200505 Zoom Meeting Connector 4.6.239.20200613 Zoom Meeting Connector 4.6.327.20200724 Zoom Meeting Connector 4.6.348.20201217 Zoom Meeting Connector 4.6.358.20210205 Zoom Meeting Connector 4.6.360.20210325 Zoom Meeting Connector 4.6.363.20210429 Zoom Meeting Connector 4.6.365.20210703 Zoom Meeting Connector 4.7.1071.20210817 Zoom Meeting Connector 4.7.1072.20210826	24

Common Weakness Enumeration (CWE)

CWE-787 - Out-of-bounds Write

References

https://explore.zoom.us/en/trust/security/security-bulletin/