TI-2022-11389 Aliases CVE-2022-28759 GHSA-x49r-3x2g-9xh4

Zoom On-Premise Deployments: Improper Access Control

MEDIUM 44CWE-284Published 2022-10-14 · Updated 2025-05-14

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could obtain the audio and video feed of a meeting they were not authorized to join and cause other meeting disruptions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0068 52nd percentileScored 2026-11-07

Fix Fixed Zoom On-Premise Meeting Connector MMR (Zoom Video Communications Inc): 4.8.20220815.130

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Zoom Video Communications, Inc.	Zoom On-Premise Meeting Connector MMR	before 4.8.20220815.130	4.8.20220815.130	Patch available	CNA

Zoom On-Premise Meeting Connector MMR VendorZoom Video Communications, Inc. Affected before 4.8.20220815.130 Fixed in 4.8.20220815.130 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:zoom:zoom_on-premise_meeting_connector_mmr::::::::	before 4.8.20220815.130	Vulnerable	Zoom Video Communications, Inc.

cpe:2.3:a:zoom:zoom_on-premise_meeting_connector_mmr:*:*:*:*:*:*:*:* Versions before 4.8.20220815.130 Vulnerable ·Zoom Video Communications, Inc.

Remediation

Fix · CNA Zoom On-Premise Meeting Connector MMR (Zoom Video Communications Inc) Fixed in 4.8.20220815.130

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2022-10-14
Zoom On-Premise Meeting Connector MMR 4.8.20220815.130
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2022-11390 Zoom On-Premise Deployments: Improper Access ControlPriority LOW 30
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2022-28759
2026-10-03 Alias added: GHSA-x49r-3x2g-9xh4
2026-10-11 EPSS moved to the 50th–90th percentile

References

Advisory 1

https://explore.zoom.us/en/trust/security/security-bulletin/

TI-2021-13457 Buffer overflow in Zoom client and other products CVSS 3.1CRITICAL 9.8
TI-2022-11388 Zoom On-Premise Deployments: Improper Access Control CVSS 3.1HIGH 8.2
TI-2021-13451 Authenticated remote command execution with root privileges via web console in MMR CVSS 3.1HIGH 7.9
TI-2021-13458 Process memory exposure in Zoom Client and other products CVSS 3.1HIGH 7.5
TI-2022-07032 Process memory exposure in Zoom on-premise Meeting services CVSS 3.1HIGH 7.5
TI-2022-11391 Zoom On-Premise Deployments: Improper Access Control CVSS 3.1MEDIUM 6.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences