CVE-2022-28753 json
Zoom On-Premise Deployments: Improper Access Control Vulnerability
published 2022-08-11 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-33192
- cvss
- 7.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 45%
- public exploits
- 0
- none known
Summary
Zoom On-Premise Meeting Connector MMR before version 4.8.129.20220714 contains an improper access control vulnerability. As a result, a malicious actor can join a meeting which they are authorized to join without appearing to the other participants, can admit themselves into the meeting from the waiting room, and can become host and cause other meeting disruptions.
Patch / fix
- Zoom Video Communications Inc Zoom On-Premise Meeting Connector MMR 4.8.129.20220714
Exploit prediction
0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 7.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N |
| NVD | 3.1 | 5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
Affected products
- Zoom Video Communications Inc Zoom On-Premise Meeting Connector MMR
Classification
- Weakness
-
- CWE-284 Improper Access Control
References
-
explore.zoom.us
/en/trust/security/security-bulletin/
vendor-advisory
Sources
- CVE List CVE-2022-28753
- NVD CVE-2022-28753
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.