{"id":"CVE-2022-22784","state":"PUBLISHED","title":"Improper XML Parsing in Zoom Client for Meetings","description":"The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly parse XML stanzas in XMPP messages. This can allow a malicious user to break out of the current XMPP message context and create a new message context to have the receiving users client perform a variety of actions.This issue could be used in a more sophisticated attack to forge XMPP messages from the server.","publishedAt":"2022-05-18T15:41:50.592Z","updatedAt":"2024-09-16T17:59:18.129Z","severity":{"score":8.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","source":"Zoom"},"assigner":"Zoom","products":["Zoom Video Communications Inc Zoom Client for Meetings for Android","Zoom Video Communications Inc Zoom Client for Meetings for iOS","Zoom Video Communications Inc Zoom Client for Meetings for Linux","Zoom Video Communications Inc Zoom Client for Meetings for MacOS","Zoom Video Communications Inc Zoom Client for Meetings for Windows"],"affected":[{"vendor":"Zoom Video Communications Inc","product":"Zoom Client for Meetings for Android","versions":[{"version":"unspecified","status":"affected","lessThan":"5.10.0","versionType":"custom"}]},{"vendor":"Zoom Video Communications Inc","product":"Zoom Client for Meetings for iOS","versions":[{"version":"unspecified","status":"affected","lessThan":"5.10.0","versionType":"custom"}]},{"vendor":"Zoom Video Communications Inc","product":"Zoom Client for Meetings for Linux","versions":[{"version":"unspecified","status":"affected","lessThan":"5.10.0","versionType":"custom"}]},{"vendor":"Zoom Video Communications Inc","product":"Zoom Client for Meetings for MacOS","versions":[{"version":"unspecified","status":"affected","lessThan":"5.10.0","versionType":"custom"}]},{"vendor":"Zoom Video Communications Inc","product":"Zoom Client for Meetings for Windows","versions":[{"version":"unspecified","status":"affected","lessThan":"5.10.0","versionType":"custom"}]}],"references":["https://explore.zoom.us/en/trust/security/security-bulletin"],"weaknesses":[],"ingestedAt":"2026-10-29T19:49:38.433Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/22xxx/CVE-2022-22784.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-22784","state":"PUBLISHED","datePublished":"2022-05-18T15:41:50.592Z","dateUpdated":"2024-09-16T17:59:18.129Z","assignerShortName":"Zoom","assignerOrgId":"99b9af0d-a833-4a5d-9e2f-8b1324f35351","dateReserved":"2022-01-07T00:00:00.000Z"},"containers":{"cna":{"title":"Improper XML Parsing in Zoom Client for Meetings","descriptions":[{"lang":"en","value":"The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly parse XML stanzas in XMPP messages. This can allow a malicious user to break out of the current XMPP message context and create a new message context to have the receiving users client perform a variety of actions.This issue could be used in a more sophisticated attack to forge XMPP messages from the server."}],"affected":[{"vendor":"Zoom Video Communications Inc","product":"Zoom Client for Meetings for Android","versions":[{"version":"unspecified","status":"affected","lessThan":"5.10.0","versionType":"custom"}]},{"vendor":"Zoom Video Communications Inc","product":"Zoom Client for Meetings for iOS","versions":[{"version":"unspecified","status":"affected","lessThan":"5.10.0","versionType":"custom"}]},{"vendor":"Zoom Video Communications Inc","product":"Zoom Client for Meetings for Linux","versions":[{"version":"unspecified","status":"affected","lessThan":"5.10.0","versionType":"custom"}]},{"vendor":"Zoom Video Communications Inc","product":"Zoom Client for Meetings for MacOS","versions":[{"version":"unspecified","status":"affected","lessThan":"5.10.0","versionType":"custom"}]},{"vendor":"Zoom Video Communications Inc","product":"Zoom Client for Meetings for Windows","versions":[{"version":"unspecified","status":"affected","lessThan":"5.10.0","versionType":"custom"}]}],"references":[{"url":"https://explore.zoom.us/en/trust/security/security-bulletin","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"description":"Improper Input Validation","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"Zoom","dateUpdated":"2022-05-18T15:41:50.000Z","orgId":"99b9af0d-a833-4a5d-9e2f-8b1324f35351"},"credits":[{"lang":"en","value":"Ivan Fratric of Google Project Zero"}],"datePublic":"2022-05-17T00:00:00.000Z","source":{"discovery":"USER"},"x_legacyV4Record":{"CVE_data_meta":{"AKA":"Zoom Video Communications Inc","ASSIGNER":"security@zoom.us","DATE_PUBLIC":"2022-05-17T12:00:00.000Z","ID":"CVE-2022-22784","STATE":"PUBLIC","TITLE":"Improper XML Parsing in Zoom Client for Meetings"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Zoom Client for Meetings for Android","version":{"version_data":[{"version_affected":"<","version_value":"5.10.0"}]}},{"product_name":"Zoom Client for Meetings for iOS","version":{"version_data":[{"version_affected":"<","version_value":"5.10.0"}]}},{"product_name":"Zoom Client for Meetings for Linux","version":{"version_data":[{"version_affected":"<","version_value":"5.10.0"}]}},{"product_name":"Zoom Client for Meetings for MacOS","version":{"version_data":[{"version_affected":"<","version_value":"5.10.0"}]}},{"product_name":"Zoom Client for Meetings for Windows","version":{"version_data":[{"version_affected":"<","version_value":"5.10.0"}]}}]},"vendor_name":"Zoom Video Communications Inc"}]}},"credit":[{"lang":"eng","value":"Ivan Fratric of Google Project Zero"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly parse XML stanzas in XMPP messages. This can allow a malicious user to break out of the current XMPP message context and create a new message context to have the receiving users client perform a variety of actions.This issue could be used in a more sophisticated attack to forge XMPP messages from the server."}]},"impact":{"cvss":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Improper Input Validation"}]}]},"references":{"reference_data":[{"name":"https://explore.zoom.us/en/trust/security/security-bulletin","refsource":"MISC","url":"https://explore.zoom.us/en/trust/security/security-bulletin"}]},"source":{"discovery":"USER"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://explore.zoom.us/en/trust/security/security-bulletin","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T03:21:49.159Z"}}]}}}