« Volver al listado

CVE-2022-22780

Estado: ModificadaMedia (6.5)—

The Zoom Client for Meetings chat functionality was susceptible to Zip bombing attacks in the following product versions: Android before version 5.8.6, iOS before version 5.9.0, Linux before version 5.8.6, macOS before version 5.7.3, and Windows before version 5.6.3. This could lead to availability issues on the client host by exhausting system resources.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Zoom — Meetings

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-22780",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security@zoom.us",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 4.7,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "security@zoom.us",
      "affectedData": [
        {
          "vendor": "Zoom Video Communications Inc",
          "product": "Zoom Client for Meetings for Android",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "5.8.6",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Zoom Video Communications Inc",
          "product": "Zoom Client for Meetings for iOS",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "5.9.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Zoom Video Communications Inc",
          "product": "Zoom Client for Meetings for Linux",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "5.8.6",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Zoom Video Communications Inc",
          "product": "Zoom Client for Meetings for macOS",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "5.7.3",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "Zoom Video Communications Inc",
          "product": "Zoom Client for Meetings for Windows",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified",
              "lessThan": "5.6.3",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-02-09T23:15:19.150",
  "references": [
    {
      "url": "https://explore.zoom.us/en/trust/security/security-bulletin",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security@zoom.us"
    },
    {
      "url": "https://explore.zoom.us/en/trust/security/security-bulletin",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Zoom Client for Meetings chat functionality was susceptible to Zip bombing attacks in the following product versions: Android before version 5.8.6, iOS before version 5.9.0, Linux before version 5.8.6, macOS before version 5.7.3, and Windows before version 5.6.3. This could lead to availability issues on the client host by exhausting system resources."
    },
    {
      "lang": "es",
      "value": "La funcionalidad chat de Zoom Client for Meetings era susceptible de sufrir ataques de bombardeo de Zip en las siguientes versiones del producto: Android versiones anteriores a 5.8.6, iOS versiones anteriores a 5.9.0, Linux versiones anteriores a 5.8.6, macOS versiones anteriores a 5.7.3 y Windows versiones anteriores a 5.6.3. Esto podría conllevar a problemas de disponibilidad en el host cliente al agotar los recursos del sistema"
    }
  ],
  "lastModified": "2026-06-17T04:29:01.783",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:zoom:meetings:*:*:*:*:*:windows:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CC39A599-FC9F-4969-9CC7-71FE55025C08",
              "versionEndExcluding": "5.6.3"
            },
            {
              "criteria": "cpe:2.3:a:zoom:meetings:*:*:*:*:*:macos:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1605E28D-0488-49DA-9098-010813523159",
              "versionEndExcluding": "5.7.3"
            },
            {
              "criteria": "cpe:2.3:a:zoom:meetings:*:*:*:*:*:android:*:*",
              "vulnerable": true,
              "matchCriteriaId": "97D6B6D9-A656-4D2C-A627-1766206644B8",
              "versionEndExcluding": "5.8.6"
            },
            {
              "criteria": "cpe:2.3:a:zoom:meetings:*:*:*:*:*:linux:*:*",
              "vulnerable": true,
              "matchCriteriaId": "55F568FB-8385-46CC-9C22-EA55E0019B34",
              "versionEndExcluding": "5.8.6"
            },
            {
              "criteria": "cpe:2.3:a:zoom:meetings:*:*:*:*:*:iphone_os:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1FE37907-1E61-4341-8302-941E50B192DB",
              "versionEndExcluding": "5.9.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security@zoom.us"
}