title: Improper URL parsing in Zoom Clients
description: The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.11.0 are susceptible to a URL parsing vulnerability. If a malicious Zoom meeting URL is opened, the malicious link may direct the user to connect to an arbitrary network address, leading to additional attacks including the potential for remote code execution through launching executables from arbitrary paths.
problem types: CWE-20 Improper Input Validation
affected:
{
product: Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows)
vendor: Zoom Video Communications Inc
versions:
lessThan: 5.11.0, status: affected, version: unspecified, versionType: custom
}
{
product: Zoom VDI Windows Meeting Clients
vendor: Zoom Video Communications Inc
versions:
lessThan: 5.10.7, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.6
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
version: 3.1
]