Description
The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom domains. This issue could be used in a more sophisticated attack to send an unsuspecting users Zoom-scoped session cookies to a non-Zoom domain. This could potentially allow for spoofing of a Zoom user.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Zoom Video Communications Inc Zoom Client for Meetings for Android
unspecified to < 5.10.0affected
Zoom Video Communications Inc Zoom Client for Meetings for iOS
unspecified to < 5.10.0affected
Zoom Video Communications Inc Zoom Client for Meetings for Linux
unspecified to < 5.10.0affected
Zoom Video Communications Inc Zoom Client for Meetings for MacOS
unspecified to < 5.10.0affected
Zoom Video Communications Inc Zoom Client for Meetings for Windows
unspecified to < 5.10.0affected