CVE-2022-28754highCWE-284

CVE-2022-28754: high-severity vulnerability in Zoom On-Premise Meeting Connector MMR

Zoom On-Premise Deployments: Improper Access Control Vulnerability

Published · Updated

Follow this CVE+ Monitor Zoom On-Premise Meeting Connector MMR

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.1epss 0.6%
Zoom On-Premise Meeting Connector MMR before version 4.8.129.20220714 contains an improper access control vulnerability. As a result, a malicious actor can join a meeting which they are authorized to join without appearing to the other participants, can admit themselves into the meeting from the waiting room, and can become host and cause other meeting disruptions.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Affected products
Zoom Video Communications Inc · Zoom On-Premise Meeting Connector MMR
Related CVEs — Zoom On-Premise Meeting Connector MMR

In the same product, most dangerous first.

CVE-2021-34423HIGHBuffer overflow in Zoom client and other productsEPSS 3.3%CVE-2021-34417HIGHAuthenticated remote command execution with root privileges via web console in MMREPSS 1.2%CVE-2022-22783MEDIUMProcess memory exposure in Zoom on-premise Meeting servicesEPSS 1.0%CVE-2022-28761MEDIUMZoom On-Premise Deployments: Improper Access ControlEPSS 0.8%CVE-2022-28758HIGHZoom On-Premise Deployments: Improper Access ControlEPSS 0.7%CVE-2022-28759HIGHZoom On-Premise Deployments: Improper Access ControlEPSS 0.7%