Severity
High
Analysis Summary
CVE-2022-36930 CVSS:8.2
Zoom Rooms for Windows could allow a local authenticated attacker to gain elevated privileges on the system, caused by a flaw. in the installers. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges to the SYSTEM user.
CVE-2022-36929 CVSS:7.8
Zoom Rooms for Windows clients could allow a local authenticated attacker to gain elevated privileges on the system, caused by an unspecified flaw. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges to the SYSTEM user.
CVE-2022-36928 CVSS:6.1
Zoom for Android clients could allow a remote attacker to traverse directories on the system, caused by improper validation of user request. An attacker could send a specially-crafted URL request containing “dot dot” sequences (/../) to read and write arbitrary files to the Zoom application data directory.
CVE-2022-36927 CVSS:8.8
Zoom Rooms for macOS could allow a local authenticated attacker to gain elevated privileges on the system, caused by an unspecified flaw. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges as root.
CVE-2022-36926 CVSS:8.8
Zoom Rooms for macOS could allow a local authenticated attacker to gain elevated privileges on the system, caused by an unspecified flaw. By sending a specially-crafted request, an authenticated attacker could exploit this vulnerability to gain elevated privileges as root.
CVE-2022-36925 CVSS:4.4
Zoom Rooms for macOS could allow a local authenticated attacker to bypass security restrictions, caused by an insecure key generation mechanism. By sending a specially-crafted request using the encryption key, an attacker could exploit this vulnerability to interact with the daemon service to execute privileged functions and cause a local denial of service.
Impact
- Privilege Escalation
- Directory Traversal
- Security Bypass
Indicators Of Compromise
CVE
- CVE-2022-36930
- CVE-2022-36929
- CVE-2022-36928
- CVE-2022-36927
- CVE-2022-36926
- CVE-2022-36925
Affected Vendors
Zoom
Affected Products
- Zoom Rooms for Windows clients 5.12
- Zoom for Android clients 5.12.0
- Zoom Rooms for macOS 5.11
Remediation
Refer to Zoom Security Advisory for patch, upgrade or suggested workaround information.