cvelist/2022/22xxx/CVE-2022-22785.json

{
    "CVE_data_meta": {
        "AKA": "Zoom Video Communications Inc",
        "ASSIGNER": "security@zoom.us",
        "DATE_PUBLIC": "2022-05-17T12:00:00.000Z",
        "ID": "CVE-2022-22785",
        "STATE": "PUBLIC",
        "TITLE": "Improperly constrained session cookies in Zoom Client for Meetings"
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "product": {
                        "product_data": [
                            {
                                "product_name": "Zoom Client for Meetings for Android",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_affected": "<",
                                            "version_value": "5.10.0"
                                        }
                                    ]
                                }
                            },
                            {
                                "product_name": "Zoom Client for Meetings for iOS",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_affected": "<",
                                            "version_value": "5.10.0"
                                        }
                                    ]
                                }
                            },
                            {
                                "product_name": "Zoom Client for Meetings for Linux",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_affected": "<",
                                            "version_value": "5.10.0"
                                        }
                                    ]
                                }
                            },
                            {
                                "product_name": "Zoom Client for Meetings for MacOS",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_affected": "<",
                                            "version_value": "5.10.0"
                                        }
                                    ]
                                }
                            },
                            {
                                "product_name": "Zoom Client for Meetings for Windows",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_affected": "<",
                                            "version_value": "5.10.0"
                                        }
                                    ]
                                }
                            }
                        ]
                    },
                    "vendor_name": "Zoom Video Communications Inc"
                }
            ]
        }
    },
    "credit": [
        {
            "lang": "eng",
            "value": "Ivan Fratric of Google Project Zero"
        }
    ],
    "data_format": "MITRE",
    "data_type": "CVE",
    "data_version": "4.0",
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "The Zoom Client for Meetings (for Android, iOS, Linux, MacOS, and Windows) before version 5.10.0 failed to properly constrain client session cookies to Zoom domains. This issue could be used in a more sophisticated attack to send an unsuspecting users Zoom-scoped session cookies to a non-Zoom domain. This could potentially allow for spoofing of a Zoom user."
            }
        ]
    },
    "impact": {
        "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L",
            "version": "3.1"
        }
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "Exposure of Resource to Wrong Sphere"
                    }
                ]
            }
        ]
    },
    "references": {
        "reference_data": [
            {
                "refsource": "MISC",
                "url": "https://explore.zoom.us/en/trust/security/security-bulletin",
                "name": "https://explore.zoom.us/en/trust/security/security-bulletin"
            }
        ]
    },
    "source": {
        "discovery": "USER"
    }
}