{"id":"CVE-2022-22787","state":"PUBLISHED","title":"Insufficient hostname validation during Clusterswitch message in Zoom Client for Meetings","description":"The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0 fails to properly validate the hostname during a server switch request. This issue could be used in a more sophisticated attack to trick an unsuspecting users client to connect to a malicious server when attempting to use Zoom services.","publishedAt":"2022-05-18T16:03:18.179Z","updatedAt":"2024-09-17T04:14:00.754Z","severity":{"score":5.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L","source":"Zoom"},"assigner":"Zoom","products":["Zoom Video Communications Inc Zoom Client for Meetings for Android","Zoom Video Communications Inc Zoom Client for Meetings for iOS","Zoom Video Communications Inc Zoom Client for Meetings for Linux","Zoom Video Communications Inc Zoom Client for Meetings for MacOS","Zoom Video Communications Inc Zoom Client for Meetings for Windows"],"affected":[{"vendor":"Zoom Video Communications Inc","product":"Zoom Client for Meetings for Android","versions":[{"version":"unspecified","status":"affected","lessThan":"5.10.0","versionType":"custom"}]},{"vendor":"Zoom Video Communications Inc","product":"Zoom Client for Meetings for iOS","versions":[{"version":"unspecified","status":"affected","lessThan":"5.10.0","versionType":"custom"}]},{"vendor":"Zoom Video Communications Inc","product":"Zoom Client for Meetings for Linux","versions":[{"version":"unspecified","status":"affected","lessThan":"5.10.0","versionType":"custom"}]},{"vendor":"Zoom Video Communications Inc","product":"Zoom Client for Meetings for MacOS","versions":[{"version":"unspecified","status":"affected","lessThan":"5.10.0","versionType":"custom"}]},{"vendor":"Zoom Video Communications Inc","product":"Zoom Client for Meetings for Windows","versions":[{"version":"unspecified","status":"affected","lessThan":"5.10.0","versionType":"custom"}]}],"references":["https://explore.zoom.us/en/trust/security/security-bulletin","http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html"],"weaknesses":[],"ingestedAt":"2026-10-29T19:49:38.433Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/22xxx/CVE-2022-22787.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-22787","state":"PUBLISHED","datePublished":"2022-05-18T16:03:18.179Z","dateUpdated":"2024-09-17T04:14:00.754Z","assignerShortName":"Zoom","assignerOrgId":"99b9af0d-a833-4a5d-9e2f-8b1324f35351","dateReserved":"2022-01-07T00:00:00.000Z"},"containers":{"cna":{"title":"Insufficient hostname validation during Clusterswitch message in Zoom Client for Meetings","descriptions":[{"lang":"en","value":"The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0 fails to properly validate the hostname during a server switch request. This issue could be used in a more sophisticated attack to trick an unsuspecting users client to connect to a malicious server when attempting to use Zoom services."}],"affected":[{"vendor":"Zoom Video Communications Inc","product":"Zoom Client for Meetings for Android","versions":[{"version":"unspecified","status":"affected","lessThan":"5.10.0","versionType":"custom"}]},{"vendor":"Zoom Video Communications Inc","product":"Zoom Client for Meetings for iOS","versions":[{"version":"unspecified","status":"affected","lessThan":"5.10.0","versionType":"custom"}]},{"vendor":"Zoom Video Communications Inc","product":"Zoom Client for Meetings for Linux","versions":[{"version":"unspecified","status":"affected","lessThan":"5.10.0","versionType":"custom"}]},{"vendor":"Zoom Video Communications Inc","product":"Zoom Client for Meetings for MacOS","versions":[{"version":"unspecified","status":"affected","lessThan":"5.10.0","versionType":"custom"}]},{"vendor":"Zoom Video Communications Inc","product":"Zoom Client for Meetings for Windows","versions":[{"version":"unspecified","status":"affected","lessThan":"5.10.0","versionType":"custom"}]}],"references":[{"url":"https://explore.zoom.us/en/trust/security/security-bulletin","tags":["x_refsource_CONFIRM"]},{"url":"http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html","tags":["x_refsource_MISC"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L","version":"3.1"}}],"problemTypes":[{"descriptions":[{"description":"Improper Input Validation","lang":"en","type":"text"}]}],"providerMetadata":{"shortName":"Zoom","dateUpdated":"2022-05-24T19:06:09.000Z","orgId":"99b9af0d-a833-4a5d-9e2f-8b1324f35351"},"credits":[{"lang":"en","value":"Ivan Fratric of Google Project Zero"}],"datePublic":"2022-05-17T00:00:00.000Z","source":{"discovery":"USER"},"x_legacyV4Record":{"CVE_data_meta":{"AKA":"Zoom Video Communications Inc","ASSIGNER":"security@zoom.us","DATE_PUBLIC":"2022-05-17T12:00:00.000Z","ID":"CVE-2022-22787","STATE":"PUBLIC","TITLE":"Insufficient hostname validation during Clusterswitch message in Zoom Client for Meetings"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Zoom Client for Meetings for Android","version":{"version_data":[{"platform":"","version_affected":"<","version_name":"","version_value":"5.10.0"}]}},{"product_name":"Zoom Client for Meetings for iOS","version":{"version_data":[{"platform":"","version_affected":"<","version_name":"","version_value":"5.10.0"}]}},{"product_name":"Zoom Client for Meetings for Linux","version":{"version_data":[{"platform":"","version_affected":"<","version_name":"","version_value":"5.10.0"}]}},{"product_name":"Zoom Client for Meetings for MacOS","version":{"version_data":[{"platform":"","version_affected":"<","version_name":"","version_value":"5.10.0"}]}},{"product_name":"Zoom Client for Meetings for Windows","version":{"version_data":[{"platform":"","version_affected":"<","version_name":"","version_value":"5.10.0"}]}}]},"vendor_name":"Zoom Video Communications Inc"}]}},"configuration":[],"credit":[{"lang":"eng","value":"Ivan Fratric of Google Project Zero"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.10.0 fails to properly validate the hostname during a server switch request. This issue could be used in a more sophisticated attack to trick an unsuspecting users client to connect to a malicious server when attempting to use Zoom services."}]},"exploit":[],"impact":{"cvss":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":5.9,"baseSeverity":"MEDIUM","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L","version":"3.1"}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Improper Input Validation"}]}]},"references":{"reference_data":[{"name":"https://explore.zoom.us/en/trust/security/security-bulletin","refsource":"CONFIRM","url":"https://explore.zoom.us/en/trust/security/security-bulletin"},{"name":"http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html","refsource":"MISC","url":"http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html"}]},"solution":[],"source":{"advisory":"","defect":[],"discovery":"USER"},"work_around":[]}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://explore.zoom.us/en/trust/security/security-bulletin","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://packetstormsecurity.com/files/167238/Zoom-XMPP-Stanza-Smuggling-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-03T03:21:49.132Z"}}]}}}