Zoom On-Premise Deployments: Improper Access Control Vulnerability

Vulnerability

The Zoom On-Premise Meeting Connector MMR component before version 4.8.129.20220714 contains an improper access control vulnerability [1]. This flaw allows a malicious actor to perform unauthorized actions within a meeting they are otherwise authorized to join.

Exploitation

An attacker who is authorized to join a meeting (e.g., has valid credentials or a meeting link) can exploit the access control weakness. The attacker can join the meeting without appearing to other participants, admit themselves from the waiting room, and escalate privileges to become the host, enabling further meeting disruptions.

Impact

Successful exploitation grants the attacker the ability to join meetings invisibly, bypass waiting room restrictions, gain host privileges, and cause disruptions such as removing participants or altering meeting settings. This compromises the integrity and availability of the meeting and may lead to unauthorized information disclosure.

Mitigation

Upgrade to Zoom On-Premise Meeting Connector MMR version 4.8.129.20220714 or later [1]. No workarounds are documented; applying the update is the recommended action.