Zoom On-Premise Deployments: Improper Access Control

Vulnerability

An improper access control vulnerability exists in Zoom On-Premise Meeting Connector MMR prior to version 4.8.20220815.130 [1]. The flaw allows an attacker who is not authorized to join a meeting to obtain the audio and video feed of that meeting [1].

Exploitation

A malicious actor can exploit this vulnerability by leveraging the improper access controls in the Meeting Connector MMR component to join a meeting without proper authorization [1]. No additional special privileges or user interaction beyond network access to the affected service are required [1].

Impact

Successful exploitation enables the attacker to gain unauthorized access to the audio and video streams of a meeting they were not permitted to attend [1]. The attacker can also cause other disruptions to the meeting [1].

Mitigation

Zoom has addressed this vulnerability with the release of version 4.8.20220815.130 [1]. Users should upgrade to this version or later to remediate the flaw [1].