CVE-2025-27442: Zoom Workplace Apps - Cross Site Scripting
Published Apr 8, 2025
·Updated
Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access.
Affected Software
21 affected components
Zoom Workplace Apps
Zoom Meeting Software Development Kit Android<6.3.0
Zoom Meeting Software Development Kit Linux<6.3.0
Zoom Meeting Software Development Kit Macos<6.3.0
Zoom Meeting Software Development Kit Iphone Os<6.3.10
Zoom Meeting Software Development Kit Windows<6.3.10
Zoom Rooms Android<6.4.0
Zoom Rooms Ipados<6.4.0
Zoom Rooms Macos<6.4.0
Zoom Rooms Windows<6.4.0
Zoom Rooms Controller Android<6.4.0
Zoom Rooms Controller Linux<6.4.0
Zoom Rooms Controller Macos<6.4.0
Zoom Rooms Controller Windows<6.4.0
Zoom Workplace Android<6.3.10
Zoom Workplace Iphone Os<6.3.10
Zoom Workplace Desktop Linux<6.3.10
Zoom Workplace Desktop Macos<6.3.10
Zoom Workplace Desktop Windows<6.3.10
Zoom Workplace Virtual Desktop Infrastructure Windows<6.1.16
Zoom Workplace Virtual Desktop Infrastructure Windows>=6.1.17<6.2.12
Event History
Apr 8, 2025
CVE Published
via MITRE·04:14 PM
Data Sourced
via MITRE·04:14 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:15 PM
DescriptionSeverityWeaknessAffected Software
Feb 25, 57795
Event
via NVD·01:47 PM
Frequently Asked Questions
1
What is the severity of CVE-2025-27442?
CVE-2025-27442 has a moderate severity rating due to potential cross-site scripting vulnerabilities.
2
How do I fix CVE-2025-27442?
To mitigate CVE-2025-27442, ensure you are using the latest version of Zoom Workplace Apps with all security patches applied.
3
Who is affected by CVE-2025-27442?
Users of Zoom Workplace Apps are potentially affected by CVE-2025-27442.
4
Can CVE-2025-27442 be exploited remotely?
Yes, CVE-2025-27442 may be exploited via adjacent network access, allowing unauthenticated users to conduct attacks.
5
What are the potential impacts of CVE-2025-27442?
The potential impacts of CVE-2025-27442 include loss of integrity due to cross-site scripting vulnerabilities.