CVE-2022-28755: 
NixOS vulnerability analysis and mitigation

The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.11.0 was affected by a URL parsing vulnerability identified as CVE-2022-28755. The vulnerability was discovered and disclosed in April 2022, as indicated by the CVE record creation date of April 6, 2022 (CVE Details).

The vulnerability is related to improper URL parsing in the Zoom client applications. The CVSS v3.1 score assigned by NIST is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, indicating a network-exploitable vulnerability with low attack complexity, requiring user interaction, and potentially impacting confidentiality and integrity (NVD). The weakness was categorized as CWE-601, related to URL redirection to untrusted sites.

If exploited, the vulnerability could allow an attacker to direct users to connect to an arbitrary network address when opening a malicious Zoom meeting URL. This could lead to additional attacks, including the potential for remote code execution through launching executables from arbitrary paths (CVE Details).

The vulnerability was addressed in Zoom Client for Meetings version 5.11.0. Users are recommended to update to this version or later to receive the security fix (Zoom Security Bulletin).