CVE-2022-22784 is a high-severity vulnerability affecting Zoom Client for Meetings across multiple operating systems (Android, iOS, Linux, macOS, Windows) prior to version 5.10.0. It stems from improper XML stanza parsing in XMPP messages, allowing an authenticated attacker to manipulate message contexts and potentially forge server-side XMPP messages. With a CVSS score of 8.1 (High), this vulnerability has a low attack complexity and can lead to high confidentiality and integrity impacts, though it does not affect availability. While there is no known active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), it has garnered significant community discussion and media attention, including reports of a "zero-click" RCE possibility.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 5.10.0CPE matchmatch criteria | cpe:2.3:a:zoom:meetings:*:*:*:*:*:android:*:* | ||
< 5.10.0CPE matchmatch criteria | cpe:2.3:a:zoom:meetings:*:*:*:*:*:iphone_os:*:* | ||
< 5.10.0CPE matchmatch criteria | cpe:2.3:a:zoom:meetings:*:*:*:*:*:linux:*:* | ||
< 5.10.0CPE matchmatch criteria | cpe:2.3:a:zoom:meetings:*:*:*:*:*:macos:*:* | ||
< 5.10.0CPE matchmatch criteria | cpe:2.3:a:zoom:meetings:*:*:*:*:*:windows:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.